aws-bedrockagentcore: addLambdaTarget accepts unsupported OAuth credential providers and fails only at deployment time

### Describe the bug

GatewayTargetLambdaProps exposes the credentialProviderConfigurations property with the generic ICredentialProviderConfig[] type.

This allows configuring OAuth credential providers for Lambda targets:

```
gateway.addLambdaTarget("ToolsTarget", {
gatewayTargetName: "tools",
lambdaFunction,
toolSchema,
credentialProviderConfigurations: [
agentcore.GatewayCredentialProvider.fromOauthIdentity(
credentialProvider,
{
scopes: [
"https://www.googleapis.com/auth/drive.readonly",
],
},
),
],
});
```

The code compiles successfully and cdk synth succeeds.

However, deployment fails because AgentCore Gateway only supports GATEWAY_IAM_ROLE authentication for Lambda targets.

The current behavior allows an invalid configuration to pass through TypeScript and synthesis, only to fail at deployment time.

### Regression Issue

- [ ] Select this option if this issue appears to be a regression.

### Last Known Working CDK Library Version

_No response_

### Expected Behavior

One of the following:

1. Restrict GatewayTargetLambdaProps so that only IAM-based credential providers are accepted.
2. Add validation during synthesis and fail with a clear error message.
3. Improve the API shape so unsupported credential providers cannot be configured for Lambda targets.

### Current Behavior

TypeScript compilation succeeds.
CDK synthesis succeeds.
Deployment fails because OAuth credential providers are not supported for Lambda targets.

### Reproduction Steps

1. Create a Gateway.
2. Add a Lambda target using addLambdaTarget.
3. Configure credentialProviderConfigurations with GatewayCredentialProvider.fromOauthIdentity(...).
4. Run deployment.
5. Observe deployment failure from the AgentCore Gateway service.

### Possible Solution

_No response_

### Additional Information/Context

The documentation already states:

> Lambda targets only support IAM role authentication.

However, the current type definition still permits unsupported credential provider configurations, making this limitation discoverable only at deployment time.

### AWS CDK Library version (aws-cdk-lib)

aws-cdk-lib@2.257.0

### AWS CDK CLI version

2.1119.0 (build 820ac02)

### Node.js Version

24

### OS

macOS 26.5

### Language

TypeScript

### Language Version

_No response_

### Other information

_No response_

Start at addLambdaTarget and the GatewayTargetLambdaProps credentialProviderConfigurations type, then inspect how GatewayCredentialProvider.fromOauthIdentity is accepted. Reproduce the example and run cdk synth to confirm the invalid configuration passes; done means unsupported OAuth providers are rejected before deployment with a clear error or excluded by the API shape.

Written by the indexing model from the issue text.