aws-rds: Support manageMasterUserPassword for DatabaseInstanceFromSnapshot

### Describe the feature

Add `manageMasterUserPassword` support to `DatabaseInstanceFromSnapshotProps`.

### Use Case

`DatabaseInstance` and `DatabaseClusterFromSnapshot` already support `manageMasterUserPassword` (added in #35734), but `DatabaseInstanceFromSnapshot` does not. Per the [`RestoreDBInstanceFromDBSnapshot` API docs](https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_RestoreDBInstanceFromDBSnapshot.html), this applies to RDS for Oracle only.

An Oracle user restoring an instance from a snapshot currently has to use the L1 escape hatch:

```ts
(instance.node.defaultChild as rds.CfnDBInstance).addPropertyOverride('ManageMasterUserPassword', true);
```

### Proposed Solution

Add `manageMasterUserPassword` to `DatabaseInstanceFromSnapshotProps` with a synth-time validation that rejects non-Oracle engines.

### Other information

- Related PR: #35734

### Acknowledgements

- [ ] I may be able to implement this feature request
- [ ] This feature might incur a breaking change

Start by comparing the existing manageMasterUserPassword support in DatabaseInstance and DatabaseClusterFromSnapshot, using related PR #35734 as context. Add the option to DatabaseInstanceFromSnapshotProps with synth-time validation based on the Oracle-only API behavior; done means Oracle restores accept it and non-Oracle engines are rejected.

Written by the indexing model from the issue text.