(@aws_cdk/custom_resources): from_sdk_calls() attaches incorrect permissions for Lambda InvokeCommand

### Describe the bug

I created an `AwsCustomResource` and called the Lambda service with the `InvokeCommand` action. When attaching a policy using `AwsCustomResourcePolicy.from_sdk_calls()`, it attached a policy with action `lambda:Invoke`, which is not a valid action, the correct action is `lambda:InvokeFunction`.

### Regression Issue

- [ ] Select this option if this issue appears to be a regression.

### Last Known Working CDK Version

_No response_

### Expected Behavior

I expected `lambda:InvokeFunction` to be attached to my custom resource function permission.

### Current Behavior

`lambda:Invoke` was attached to my custom resource function permission.

### Reproduction Steps

The following template should reproduce the issue once parameters are added:
```
from aws_cdk import custom_resources as cr
cr.AwsCustomResource(
self,
id='id',
install_latest_aws_sdk=True,
on_create=cr.AwsSdkCall(
service='Lambda',
action='InvokeCommand',
parameters={

}
),
policy=cr.AwsCustomResourcePolicy.from_sdk_calls(
resources=[cr.AwsCustomResourcePolicy.ANY_RESOURCE]
)
)
```

### Possible Solution

I took a quick look in [the code](https://github.com/aws/aws-cdk/blob/2ecf14a0c3e5a988532975536980d81589ea448e/packages/aws-cdk-lib/custom-resources/lib/helpers-internal/sdk-info.ts#L39) and it appears that the logic to normalize an action name strips "Command" if necessary, but it does not account for the scenario where the command name is slightly different from the necessary permission, so this logic will likely need to be modified.

### Additional Information/Context

The workaround is easy enough, we can just use `AwsCustomResourcePolicy.from_statements()` instead. However, I figured I would raise this in the event that this could impact other SDK calls.

### CDK CLI Version

2.1007.0

### Framework Version

_No response_

### Node.js Version

v22.11.0

### OS

macOS Sequoia 15.4

### Language

Python

### Language Version

Python 3.11.9

### Other information

_No response_

Start in packages/aws-cdk-lib/custom-resources/lib/helpers-internal/sdk-info.ts around line 39 and trace how SDK action names are normalized for policy permissions. Verify the generated permission for Lambda InvokeCommand and check related SDK calls for the same mismatch; done means the correct action is attached without regressing existing normalization.

Written by the indexing model from the issue text.