s3-notifications: add option to skip permissions for LambdaDestination

### Describe the feature

Similar to the `LambdaDestination` in [aws-logs-destinations](https://github.com/aws/aws-cdk/tree/main/packages/aws-cdk-lib/aws-logs-destinations):

https://github.com/aws/aws-cdk/blob/47a3ee3e7590fd085530cd16417fd506c5b9f4d7/packages/aws-cdk-lib/aws-logs-destinations/lib/lambda.ts#L13

I would like to have the same option in the `LambdaDestination` in [aws-s3-notifications](https://github.com/aws/aws-cdk/tree/main/packages/aws-cdk-lib/aws-s3-notifications).

This feature request is similar to https://github.com/aws/aws-cdk/issues/14198

### Use Case

We have an shared Lambda function (acting as a forwarder) that already has all appropriate permissions, and we don't want anyone to be able to change those permissions.

### Proposed Solution

Add an additional option `addPermissions?: boolean`

### Other Information

_No response_

### Acknowledgements

- [x] I may be able to implement this feature request
- [ ] This feature might incur a breaking change

### AWS CDK Library version (aws-cdk-lib)

2.201.0

### AWS CDK CLI version

2.1018.1

### Environment details (OS name and version, etc.)

macOS

Start by reading aws-cdk-lib/aws-logs-destinations/lib/lambda.ts at the referenced implementation, then compare it with the LambdaDestination in aws-cdk-lib/aws-s3-notifications. The work is complete when the S3 notification destination exposes the proposed addPermissions option and existing permission behavior remains unchanged by default.

Written by the indexing model from the issue text.