aws-stepfunctions-tasks: CallAwsServiceCrossRegion credentials property does not work as expected for cross-account scenarios

### Describe the bug

When using `CallAwsServiceCrossRegion` with the `credentials` property for cross-account and cross-region AWS service calls, the StateMachine execution role assumes the specified credentials role and attempts to execute the auto-generated Lambda function (created internally by `CallAwsServiceCrossRegion`) with that role. This behavior prevents cross-account scenarios where the credentials role is from another account, as the cross-account role lacks Lambda execution permissions and cannot invoke the auto-generated Lambda function in the original account's region.

**Architecture Context:**

- StateMachine in Account A (XXXXXXXXXXXX)
- Cross-account role in Account B (YYYYYYYYYYYY)
- Lambda function auto-generated by `CallAwsServiceCrossRegion` and deployed in Account A's ap-northeast-1 region
- Target AWS service calls need to be made in Account B using Account B's permissions

### Regression Issue

- [ ] Select this option if this issue appears to be a regression.

### Last Known Working CDK Library Version

2.202.0

### Expected Behavior

- The Lambda function should execute with its normal execution role (Account A)
- The `credentials` role should only be used for AWS SDK calls to the target service in Account B
- Cross-account AWS service calls should work seamlessly

### Current Behavior

- StateMachine execution role assumes the `credentials` role from Account B
- The assumed cross-account role attempts to execute the Lambda function in Account A
- Lambda execution fails with `lambda:InvokeFunction` permission error
- AWS SDK calls to target services cannot be performed

The current implementation appears to assume the credentials role at the StateMachine level rather than passing it to the Lambda function for AWS SDK calls only. This causes the cross-account role to attempt Lambda execution, which it lacks permissions for. This may be the intended design, but it creates challenges for cross-account use cases.

Error message:

```text
User: arn:aws:sts::YYYYYYYYYYYY:assumed-role/AccountBRole/ArHOvqMjmgomDQtEhSPnYAJQkCjBRGuQ is not authorized to perform: lambda:InvokeFunction on resource: arn:aws:lambda:ap-northeast-1:XXXXXXXXXXXX:function:AccountAFunction because no resource-based policy allows the lambda:InvokeFunction action (Service: Lambda, Status Code: 403, Request ID: zzzzzzzz-zzzz-zzzz-zzzz-zzzzzzzzzzzz) (SDK Attempt Count: 1)
```

### Reproduction Steps

1. Create a `CallAwsServiceCrossRegion` task with cross-account credentials:

```typescript
new tasks.CallAwsServiceCrossRegion(this, 'Foo', {
service: 'ec2',
action: 'describeNetworkInsightsAccessScopes',
region: sfn.JsonPath.stringAt('$region'),
iamResources: ['*'],
credentials: {
role: sfn.TaskRole.fromRoleArnJsonPath('$anotherAccountRoleArn'),
},
});
```

2. Set up cross-account scenario:
- Account A (XXXXXXXXXXXX): Contains StateMachine and auto-generated Lambda function (created by `CallAwsServiceCrossRegion`)
- Account B (YYYYYYYYYYYY): Contains IAM Role that trusts Account A's StateMachine and has Network Access Analyzer execution policies

3. Execute the StateMachine
4. Observe the Lambda execution failure

### Possible Solution

If the current behavior is not intended, the `credentials` property could be modified to be used only for AWS SDK calls within the auto-generated Lambda function, not for Lambda function execution itself. The Lambda function would always execute with its normal execution role from Account A, and only assume the cross-account role when making the actual AWS service API calls.

Alternatively, if this is the intended behavior, it would be helpful to have documentation clarifying this limitation and providing guidance for cross-account scenarios, or perhaps a separate property/option for cross-account AWS SDK calls that doesn't affect Lambda execution.

### Additional Information/Context

_No response_

### AWS CDK Library version (aws-cdk-lib)

2.202.0

### AWS CDK CLI version

2.1019.2 (build c29855e)

### Node.js Version

v24.4.1

### OS

macOS

### Language

TypeScript

### Language Version

_No response_

### Other information

_No response_

Start with the CallAwsServiceCrossRegion task implementation and reproduce the cross-account example from the issue. Trace how the credentials property is applied to StateMachine execution and the auto-generated Lambda, then compare that behavior with the expected separation between Lambda execution and target AWS SDK calls. Done means the cross-account service call works without requiring the Account B role to invoke the Account A Lambda, or the limitation is clearly documented.

Written by the indexing model from the issue text.