lakeformation: Add BatchGrantPermissions and BatchRevokePermissions constructs

### Describe the feature

AWS CDK currently only supports individual Lake Formation permission operations through `CfnPrincipalPermissions`, which uses single `GrantPermissions` API calls. AWS Lake Formation provides
`BatchGrantPermissions` and `BatchRevokePermissions` APIs that are more resilient for bulk operations and prevent `ConcurrentModificationException` errors, but these are not available as
CDK constructs.

### Use Case

I'm always frustrated when deploying Lake Formation permissions for multiple users/groups because the current `CfnPrincipalPermissions` construct fails with `ConcurrentModificationException`
when multiple permissions are granted simultaneously for the same principal+resource combination.

**Real scenario**: Deploying 10+ users with Lake Formation permissions results in CloudFormation failures like:
```json
{
"errorCode": "ConcurrentModificationException",
"errorMessage": "Permission update/Delete failed for Resource",
"eventName": "GrantPermissions"
}
```

This forces us to apply AwsCustomResource workarounds with retry logic
AWS officially recommends using [BatchGrantPermissions](https://docs.aws.amazon.com/lake-formation/latest/dg/troubleshooting.html#troubleshooting-problem6) to solve this exact problem, but CDK doesn't expose these APIs.

### Proposed Solution

_No response_

### Other Information

_No response_

### Acknowledgements

- [ ] I may be able to implement this feature request
- [ ] This feature might incur a breaking change

### AWS CDK Library version (aws-cdk-lib)

2.221.0

### AWS CDK CLI version

2.1031.0 (build 3d7b09b)

### Environment details (OS name and version, etc.)

macOS 15.7.2

Start at the existing CfnPrincipalPermissions construct and review the linked AWS Lake Formation troubleshooting guidance for BatchGrantPermissions and BatchRevokePermissions. Done means the requested batch operations are exposed as CDK constructs with behavior and scope agreed by the project; the issue provides no file or test names, so repository discovery is required.

Written by the indexing model from the issue text.