(aws-cloudfront-origins): FunctionUrlOrigin.withOriginAccessControl does not work cross region

### Describe the bug

Assuming you have multiple lamba urls in different regions /us /au /eu etc .

```ts
this.distribution.addBehavior(
// needs to be /us* (not /us/*) to match /us and /us/foo
`/${mappedRegion}*`,
FunctionUrlOrigin.withOriginAccessControl(lambdaStack.functionUrl), // this does not work cross region
{
allowedMethods: AllowedMethods.ALLOW_ALL,
viewerProtocolPolicy: ViewerProtocolPolicy.REDIRECT_TO_HTTPS,
compress: false,
originRequestPolicy: OriginRequestPolicy.ALL_VIEWER_EXCEPT_HOST_HEADER,
cachePolicy: CachePolicy.CACHING_DISABLED,
}
```
Cloudformation will error when the functionUrl is from a stack in a different region.
However you can manually set the Lambda url with origin access control.

### Regression Issue

- [ ] Select this option if this issue appears to be a regression.

### Last Known Working CDK Library Version

_No response_

### Expected Behavior

CDK should correctly create `FunctionUrlOrigin.withOriginAccessControl` as AWS CloudFront supports this

### Current Behavior

The CDK will rollback and error

### Reproduction Steps

```ts
... create lambda URL in a separate stack in a different region to where you are deploying cloudfront
... turn on crossRegionReferences

this.distribution.addBehavior(
// needs to be /us* (not /us/*) to match /us and /us/foo
`/${mappedRegion}*`,
FunctionUrlOrigin.withOriginAccessControl(lambdaStack.functionUrl), // this does not work across region
{
allowedMethods: AllowedMethods.ALLOW_ALL,
viewerProtocolPolicy: ViewerProtocolPolicy.REDIRECT_TO_HTTPS,
compress: false,
originRequestPolicy: OriginRequestPolicy.ALL_VIEWER_EXCEPT_HOST_HEADER,
cachePolicy: CachePolicy.CACHING_DISABLED,
}
```

### Possible Solution

Work around: manually create OAC and use a http origin

```ts
// create OAC
this.oac = new CfnOriginAccessControl(
this,
this.id('LambdaFunctionUrlOAC'),
{
originAccessControlConfig: {
name: 'LambdaFunctionUrlOAC',
originAccessControlOriginType: OriginAccessControlOriginType.LAMBDA,
signingBehavior: SigningBehavior.ALWAYS,
signingProtocol: SigningProtocol.SIGV4,
description: 'OAC for Lambda Function URL',
},
}
);

// cross region import the lambda url
// remove https://
const urlWithoutProtocol = Fn.select(
1,
Fn.split('://', lambdaStack.functionUrl)
);
const domainName = Fn.select(0, Fn.split('/', urlWithoutProtocol));

// create http origin
const httpOrigin = new HttpOrigin(domainName, {
protocolPolicy: OriginProtocolPolicy.HTTPS_ONLY,
originAccessControlId: this.oac.attrId,
});

// add to behaviour
this.distribution.addBehavior(
// needs to be /us* (not /us/*) to match /us and /us/foo
`/${mappedRegion}*`,
httpOrigin,
{
allowedMethods: AllowedMethods.ALLOW_ALL,
viewerProtocolPolicy: ViewerProtocolPolicy.REDIRECT_TO_HTTPS,
compress: false,
originRequestPolicy: OriginRequestPolicy.ALL_VIEWER_EXCEPT_HOST_HEADER,
cachePolicy: CachePolicy.CACHING_DISABLED,
}
);
```

### Additional Information/Context

_No response_

### AWS CDK Library version (aws-cdk-lib)

aws-cdk-lib@2.196.0

### AWS CDK CLI version

2.1015.0 (build d50f212)

### Node.js Version

22.15.1

### OS

Mac

### Language

TypeScript

### Language Version

_No response_

### Other information

_No response_

Start by tracing the FunctionUrlOrigin.withOriginAccessControl entry point and reproduce the cross-region setup described in the issue. Compare it with the manually created CfnOriginAccessControl and HttpOrigin workaround; done means CloudFormation can create the CloudFront origin without rollback when the Lambda URL is in another region.

Written by the indexing model from the issue text.