(aws-stepfunctions-tasks): Make `iamResources` optional for `CallAwsService`

### Describe the feature

Make `CallAwsService.iamResources` optional, so that I can manually attach the necessary permissions later on.

### Use Case

I have a recursive task that calls `sfn:listExecutions` on itself (the state machine). When I declare the task via `sfn_tasks.CallAwsService.jsonata(...)`, the state machine does not exist yet, so I can't pass it to `iamResources`. Instead, I have to instantiate the step machine first, and then attach a policy to the role later (see https://github.com/aws/aws-cdk/issues/11020 for details). However, because `iamResources` is not optional, I have to pass in some gibberish data to satisfy the "required" part, even if ultimately that policy won't be used. This doesn't lead itself to a clean code, having to pass in random gibberish data.

```ts
sfn_tasks.CallAwsService.jsonata(this, 'ListExecutions', {
service: 'sfn',
action: 'listExecutions',
parameters: {
StateMachineArn: '{% $states.context.StateMachine.Id %}',
},
// HERE! Gibberish ARN is required to satisfy the condition of having at least one resource.
iamResources: [
cdk.Arn.format({
service: 'states',
resource: 'stateMachine:XYZ',
}, cdk.Stack.of(this)),
],
});

// Create state machine here
const stateMachine = ...

// Attach a new policy to the state machine here to allow the `states:ListExecutions` action itself
const policy = ...
policy.attachToRole(stateMachine.role);
```

### Proposed Solution

Make `iamResources` optional, or at least make it accept an empty array as a valid value.

### Other Information

_No response_

### Acknowledgements

- [ ] I may be able to implement this feature request
- [ ] This feature might incur a breaking change

### AWS CDK Library version (aws-cdk-lib)

aws-cdk-lib@2.211.0

### AWS CDK CLI version

2.1025.0 (build 409f8e7)

### Environment details (OS name and version, etc.)

Win11 Arm64

Start at sfn_tasks.CallAwsService.jsonata(...) and trace how iamResources is required when constructing the task. Check the existing validation and test coverage for omitted or empty iamResources; done means callers can omit it or pass [] without placeholder data while attaching the necessary policy later.

Written by the indexing model from the issue text.