core: CloudFormation-Validate::E9002

### Describe the bug

Doing this in CDK (Python):
```
sg = aws_ec2.SecurityGroup(...)
sg.add_ingress_rule(aws_ec2.Peer.any_ipv4(), aws_ec2.Port.icmp_ping())
```

Generates the following CFN:
```
SecurityGroup:
Type: AWS::EC2::SecurityGroup
Properties:
...
SecurityGroupIngress:
- CidrIp: 0.0.0.0/0
Description: from 0.0.0.0/0:ICMP Type 8
FromPort: 8
IpProtocol: icmp
ToPort: -1
'''

Running `cdk synth` generates the following warning:
```
WARNING SecurityGroupIngress: FromPort 8 is greater than ToPort -1 (CloudFormation Validate)
test-emc-cdk-lib/EmcEc21Sg/Resource (EmcEc21Sg6A5E663D) aws-cdk-lib.aws_ec2.CfnSecurityGroup
Suggested fix: Set FromPort to a value less than or equal to ToPort
Acknowledge with 'CloudFormation-Validate::E9002'
```

I believe this issue was introduced in this change - https://github.com/aws/aws-cdk/pull/38135.
A potential fix would be to add this to error code here - https://github.com/aws/aws-cdk/blob/main/packages/aws-cdk-lib/core/lib/validation/cloudformation-validate-plugin.ts#L182.

### Regression Issue

- [ ] Select this option if this issue appears to be a regression.

### Last Known Working CDK Library Version

_No response_

### Expected Behavior

I expect the synth to complete without warnings.

### Current Behavior

Running `cdk synth` generates the following warning:
```
WARNING SecurityGroupIngress: FromPort 8 is greater than ToPort -1 (CloudFormation Validate)
test-emc-cdk-lib/EmcEc21Sg/Resource (EmcEc21Sg6A5E663D) aws-cdk-lib.aws_ec2.CfnSecurityGroup
Suggested fix: Set FromPort to a value less than or equal to ToPort
Acknowledge with 'CloudFormation-Validate::E9002'
```

### Reproduction Steps

Added in decsription.

### Possible Solution

_No response_

### Additional Information/Context

_No response_

### AWS CDK Library version (aws-cdk-lib)

v2.262.0

### AWS CDK CLI version

2.1132.1

### Node.js Version

v24.18.0

### OS

Windows

### Language

Python

### Language Version

_No response_

### Other information

_No response_

Start by reproducing the warning with the Python CDK example and `cdk synth`. Then inspect `packages/aws-cdk-lib/core/lib/validation/cloudformation-validate-plugin.ts` around the E9002 definition and verify the validation behavior for ICMP ingress, with completion indicated by synth producing no incorrect warning.

Written by the indexing model from the issue text.