custom-resource: Add VPC and IAM configuration support for auto-generated Lambda functions

### Describe the feature

When using AWS CDK high-level constructs (L2/L3), the framework automatically generates Lambda functions for various purposes such as custom resources, CloudFormation custom providers, and other internal operations. Currently, there is no built-in mechanism to:
1. Associate these auto-generated Lambda functions with a VPC - They are created in the default network configuration without VPC attachment
2. Customize IAM roles/policies for these functions - They use CDK-managed roles with broad permissions

This creates significant challenges for organizations with strict security and compliance requirements:
- Network isolation requirements cannot be met when Lambda functions run outside VPC boundaries
- Least privilege principles are violated when auto-generated functions have broader permissions than necessary

### Use Case

1. **Security Compliance**:
- Ensure all Lambda functions run within specified VPC boundaries
- Implement least privilege access through custom IAM policies
- Meet regulatory requirements for network isolation
- Control security group assignments

2. **Network Architecture**:
- Maintain consistent network configuration across all Lambda functions
- Enable access to private resources within VPC
- Control egress traffic through NAT gateways
- Apply network security controls uniformly

3. **IAM Policy Management**:
- Replace broad CDK-managed roles with specific, custom policies
- Implement organization-specific IAM policies
- Apply consistent permission boundaries
- Enable granular access control

4. **Enterprise Governance**:
- Centralize Lambda configuration management
- Enforce security standards across all auto-generated functions
- Maintain audit compliance
- Standardize resource configurations

### Proposed Solution

**Proposed Implementation Options:**

**Global Context Configuration**
```typescript
const app = new cdk.App({
context: {
'@aws-cdk/auto-lambda-vpc': 'vpc-12345',
'@aws-cdk/auto-lambda-subnet-selection': {
subnetType: ec2.SubnetType.PRIVATE_WITH_EGRESS
},
'@aws-cdk/auto-lambda-security-groups': ['sg-12345'],
'@aws-cdk/auto-lambda-role-policies': [
'arn:aws:iam::aws:policy/CustomPolicy'
]
}
});
```

**Stack-Level Configuration**
```typescript
this.configureLambdaDefaults({
vpc: myVpc,
vpcSubnets: { subnetType: ec2.SubnetType.PRIVATE_WITH_EGRESS },
securityGroups: [mySecurityGroup],
role: myCustomRole,
additionalPolicies: [
new iam.PolicyStatement({
effect: iam.Effect.ALLOW,
actions: ['logs:CreateLogGroup'],
resources: ['arn:aws:logs:*:*:*']
})
]
});
```

**Construct-Level Override**
```typescript
const customResource = new cr.Provider(this, 'Provider', {
onEventHandler: myFunction,
lambdaConfig: {
vpc: myVpc,
vpcSubnets: { subnetType: ec2.SubnetType.PRIVATE_WITH_EGRESS },
securityGroups: [mySecurityGroup],
role: myCustomRole
}
});
```

### Other Information

_No response_

### Acknowledgements

- [ ] I may be able to implement this feature request
- [ ] This feature might incur a breaking change

### AWS CDK Library version (aws-cdk-lib)

aws-cdk-lib@2.194.0

### AWS CDK CLI version

2.1025.0 (build 409f8e7)

### Environment details (OS name and version, etc.)

MacOs 15.6.1 (24G90)

Start by tracing the high-level constructs that generate custom resources, CloudFormation custom providers, and other internal Lambda functions. Compare the proposed global context, stack-level, and construct-level configuration options, then define tests showing VPC, subnet, security-group, role, and policy settings are applied consistently.

Written by the indexing model from the issue text.