(aws-cognito): SES email local part ASCII validation accepts mixed non-ASCII characters

### Describe the bug

When configuring a Cognito `UserPool` with SES email (`UserPoolEmail.withSES`), the local part of the email address is validated to be ASCII-only. The regex performing this check is unanchored (`/[\p{ASCII}]+/u`), so it only requires that the string contains *at least one* ASCII character rather than being *entirely* ASCII.

As a result, a mixed local part such as `café@example.com` (ASCII `caf` + non-ASCII `é`) incorrectly passes validation. Only a local part that is *fully* non-ASCII (e.g. `от@example.com`) is rejected. This contradicts the error message, which states the local part "must use ASCII characters only".

### Expected Behavior

Any email whose local part contains a non-ASCII character should be rejected with the `LocalPartEmailAddress` validation error, since SES/punycode only encodes the domain, not the local part.

For example, `café@example.com` should throw:

```
the local part of the email address must use ASCII characters only
```

### Current Behavior

`café@example.com` (mixed ASCII + non-ASCII local part) passes validation silently. Only fully non-ASCII local parts are rejected.

### Reproduction Steps

```ts
import { Stack } from 'aws-cdk-lib';
import { UserPool, UserPoolEmail } from 'aws-cdk-lib/aws-cognito';

const stack = new Stack();

// Expected: throws "the local part of the email address must use ASCII characters only"
// Actual: no error is thrown
new UserPool(stack, 'Pool', {
email: UserPoolEmail.withSES({
sesRegion: 'us-east-1',
fromEmail: 'café@example.com',
sesVerifiedDomain: 'example.com',
}),
});
```

### Possible Solution

Anchor the pattern to require the entire local part to be ASCII:

```diff
- if (!/[\p{ASCII}]+/u.test(local)) {
+ if (!/^[\p{ASCII}]+$/u.test(local)) {
```

### Additional Information/Context

The relevant code is in `packages/aws-cdk-lib/aws-cognito/lib/user-pool-email.ts` (`encodeAndTest`).

### AWS CDK Library version (aws-cdk-lib)

2.x (latest)

### AWS CDK CLI version

2.x (latest)

### Node.js Version

v22.16.0

### OS

macOS

### Language

TypeScript

Start in packages/aws-cdk-lib/aws-cognito/lib/user-pool-email.ts at encodeAndTest, using the reported café@example.com reproduction as the first check. Confirm that mixed non-ASCII local parts produce the LocalPartEmailAddress validation error and that fully ASCII addresses still work; verify the relevant aws-cognito tests afterward.

Written by the indexing model from the issue text.