(aws-ses): CloudFormation cannot update ConfigurationSet - fails with 403 error

### Describe the bug

Starting today, my app's deployment began failing due to CloudFormation not being able to update an `AWS::SES::ConfigurationSet`. The error we get looks like:

> | 9:53:16 PM | UPDATE_FAILED | AWS::SES::ConfigurationSet | EmailStatusHandler/ConfigurationSet (EmailStatusHandlerConfigurationSetA34BA667) Resource handler returned message: "Error occurred during operation 'The security token included in the request is invalid (Service: SesV2, Status Code: 403, Request ID: ) (SDK Attempt Count: 1)'." (RequestToken: , HandlerErrorCode: GeneralServiceException)

Looking at CloudTrail events, there's a single event within the relevant timeframe:
```json
{
"eventVersion": "1.11",
"userIdentity": {
"type": "AssumedRole",
"principalId": ":AWSCloudFormation",
"arn": "arn:aws:sts:::assumed-role/cdk-hnb659fds-cfn-exec-role--us-west-2/AWSCloudFormation",
"accountId": "",
"accessKeyId": "",
"sessionContext": {
"sessionIssuer": {
"type": "Role",
"principalId": "",
"arn": "arn:aws:iam:::role/cdk-hnb659fds-cfn-exec-role--us-west-2",
"accountId": "",
"userName": "cdk-hnb659fds-cfn-exec-role--us-west-2"
},
"attributes": {
"creationDate": "2025-07-24T19:39:21Z",
"mfaAuthenticated": "false"
}
},
"invokedBy": "cloudformation.amazonaws.com"
},
"eventTime": "2025-07-24T19:39:21Z",
"eventSource": "ses.amazonaws.com",
"eventName": "GetConfigurationSet",
"awsRegion": "us-west-2",
"sourceIPAddress": "cloudformation.amazonaws.com",
"userAgent": "cloudformation.amazonaws.com",
"requestParameters": {
"configurationSetName": "ConfigurationSet"
},
"responseElements": null,
"requestID": "c71ffc87-e716-4473-94ad-ee76752fe37e",
"eventID": "1fbfcc6a-f410-4eb8-a140-010af88aea28",
"readOnly": true,
"eventType": "AwsApiCall",
"managementEvent": true,
"recipientAccountId": "",
"eventCategory": "Management"
}
```

Notice that `responseElements` is null, where I would've expected to see at least the `ConfigurationSet`'s name. Note also that the `cfn-exec-role` - created by CDK bootstrap - has `AdminRole` permissions, so it's not obvious why we'd get a 403.

The reason this resource was being updated is that we tag all of our application stacks with certain tags, which ends up tagging all of their child nodes. I'm aware that `ConfigurationSet` doesn't support tagging, but this had been working for many months until today, and I don't know what changed. Certainly nothing in our SES-related code has changed for a long time.

### Regression Issue

- [ ] Select this option if this issue appears to be a regression.

### Last Known Working CDK Library Version

_No response_

### Expected Behavior

CloudFormation update succeeds.

### Current Behavior

CloudFormation update fails with the aforementioned error.

### Reproduction Steps

1. Attempt to deploy CDK application with a SES `ConfigurationSet`, where each deployment applies a dynamic tag (e.g. latest code commit ID or current time) to the stack where the `ConfigurationSet` is defined.
2. Observe `UPDATE_FAILED` from CloudFormation with a 403 error.

### Possible Solution

_No response_

### Additional Information/Context

_No response_

### AWS CDK Library version (aws-cdk-lib)

2.201.0

### AWS CDK CLI version

2.1003.0 (build b242c23)

### Node.js Version

v20.18.1

### OS

Amazon Linux (CodeBuild instance)

### Language

TypeScript

### Language Version

_No response_

### Other information

_No response_

Start by reproducing the deployment with an AWS::SES::ConfigurationSet and a changing stack tag, using the reported aws-cdk-lib 2.201.0 and CLI 2.1003.0 versions. Inspect the CloudFormation failure and corresponding CloudTrail GetConfigurationSet event to determine why the update receives a 403; done means the ConfigurationSet update succeeds without the invalid-token error.

Written by the indexing model from the issue text.