(cognito): refresh token rotation unsupported

### Describe the feature

[This PR](https://github.com/aws/aws-cdk/pull/10561) removed the ability to configure refresh token auth.

Unfortunately with this enabled you cannot also enable refresh token rotation.

> To enable refresh token rotation, you must disable ALLOW_REFRESH_TOKEN_AUTH in this app client and update tokens with the GetTokensFromRefreshToken operation or the /oauth2/token endpoint instead.

### Use Case

Ability to support refresh token rotation?

### Proposed Solution

Reinstate the `refreshToken` property but if not present default to true so it least follows the expected naming scheme without being breaking. If `refreshToken` is set to false then `ALLOW_REFRESH_TOKEN_AUTH` is excluded.

### Other Information

_No response_

### Acknowledgements

- [x] I may be able to implement this feature request
- [ ] This feature might incur a breaking change

### AWS CDK Library version (aws-cdk-lib)

2.202.0

### AWS CDK CLI version

N/A SST

### Environment details (OS name and version, etc.)

Darwin

Start by locating the Cognito app-client definition that controls ALLOW_REFRESH_TOKEN_AUTH and the existing refreshToken property behavior. Check how refresh token rotation relates to GetTokensFromRefreshToken and the /oauth2/token endpoint, then add coverage showing the default and false-property cases are represented correctly.

Written by the indexing model from the issue text.