(stepfunctions): Implicitly created IAM role does not follow confused deputy protection best practices

### Describe the bug

When I create a StateMachine using an implicitly created role, the role does not include the aws:SourceArn and aws:SourceAccount conditions that https://docs.aws.amazon.com/step-functions/latest/dg/procedure-create-iam-role.html#prevent-cross-service-confused-deputy recommends using to prevent confused deputy accounts.

### Regression Issue

- [ ] Select this option if this issue appears to be a regression.

### Last Known Working CDK Library Version

_No response_

### Expected Behavior

The trust policy for my implicitly created StateMachine role to look like the recommendation in the documentation:

```json
{
"Version":"2012-10-17",
"Statement":[
{
"Effect":"Allow",
"Principal":{
"Service":[
"states.amazonaws.com"
]
},
"Action":"sts:AssumeRole",
"Condition":{
"ArnLike":{
"aws:SourceArn":"arn:aws:states:us-east-1:111122223333:stateMachine:*"
},
"StringEquals":{
"aws:SourceAccount":"111122223333"
}
}
}
]
}
```

### Current Behavior

The trust policy for my implicitly created StateMachine role has no restrictions:

```json
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "states.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
}
```

### Reproduction Steps

```python
aws_stepfunctions.StateMachine(
scope=self,
id="Test",
definition_body=aws_stepfunctions.DefinitionBody.from_chainable(aws_stepfunctions.Succeed(scope=self, id="Finished")),
)
```

### Possible Solution

Add the restrictions, the `aws:SourceAccount` restriction at the very least.

### Additional Information/Context

_No response_

### AWS CDK Library version (aws-cdk-lib)

2.248.0

### AWS CDK CLI version

2.1118.0 (build 2a848bc)

### Node.js Version

v24.13.0

### OS

Linux Mint 22.3

### Language

Python

### Language Version

3.11

### Other information

_No response_

Start from the StateMachine construction path shown in the Python reproduction, including DefinitionBody.from_chainable and the implicit role creation, then inspect the generated IAM trust policy. No file or test is named in the issue; done means the implicitly created role includes the documented aws:SourceArn and aws:SourceAccount restrictions, with coverage for the reproduction.

Written by the indexing model from the issue text.