aws_logs: support for account-wide DataProtectionPolicy

### Describe the feature

The `aws_logs` subpackage currently supports creating a data protection policy on a specific log group, as per https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_logs-readme.html#data-protection-policy.

However, there's currently no way to create an account-wide data protection policy, despite it being a support feature by AWS CloudWatch, as per https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/mask-sensitive-log-data.html

### Use Case

Being able to specify a data protection policy on an account-wide level saves us from having to specify data protection policies on each individual log group manually.

### Proposed Solution

I'm not sure what an appropriate "api" for specifying an account wide DataProtectionPolicy would like. Feedback on this is requested.

One potential approach could be to add a `createGlobally`-esque prop to the existing `DataProtectionPolicy` construct.

### Other Information

Support for `DataProtectionPolicy` on a log group was added within https://github.com/aws/aws-cdk/issues/23399 / https://github.com/aws/aws-cdk/pull/23402

### Acknowledgements

- [x] I may be able to implement this feature request
- [ ] This feature might incur a breaking change

### CDK version used

2.182.0

### Environment details (OS name and version, etc.)

MacOS Sequoia 15.4, M2

Start in the aws_logs subpackage by reading the existing DataProtectionPolicy documentation and implementation referenced by the issue. Compare that behavior with AWS CloudWatch's account-wide DataProtectionPolicy support and determine an appropriate public API. Done means users can define an account-wide policy without configuring each log group individually, with coverage for the resulting behavior.

Written by the indexing model from the issue text.