aws-elasticloadbalancingv2: support sending Network Load Balancer access logs to CloudWatch Logs

### Describe the feature

NLB now can send access logs to CloudWatch logs in addition to S3: https://aws.amazon.com/about-aws/whats-new/2025/11/amazon-cloudwatch-supports-logs-network-load-balancer-access-logs/

We only support S3 currently: https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_elasticloadbalancingv2.NetworkLoadBalancer.html#logwbraccesswbrlogsbucket-prefix.

### Use Case

It's easier to query logs in CloudWatch than it is in S3.

### Proposed Solution

There is existing support in BaseLoadBalancer for sending logs to S3, but that is completely different than using CloudWatch Logs. This will just need to be a new method on NetworkLoadBalancer.

Ref: https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/AWS-logs-and-resource-policy.html#AWS-vended-logs-permissions

### Other Information

_No response_

### Acknowledgements

- [ ] I may be able to implement this feature request
- [ ] This feature might incur a breaking change

### AWS CDK Library version (aws-cdk-lib)

2.223.0

### AWS CDK CLI version

2.1029.4

### Environment details (OS name and version, etc.)

N/A

Start by comparing the existing BaseLoadBalancer S3 access-log support with the NetworkLoadBalancer entry point and its API documentation. Read the linked AWS CloudWatch Logs resource-policy guidance before checking the relevant construct tests. Done means NetworkLoadBalancer exposes CloudWatch Logs access logging with the required permissions and coverage for the new behavior.

Written by the indexing model from the issue text.