aws-rds: CloudFormation Validate W9008 false positive on Aurora cluster instances

### Describe the bug

The built-in CloudFormation Validate rule `W9008` ("RDS instance should have StorageEncrypted set to true") is raised against the instance resources of an Aurora `rds.DatabaseCluster` even when the cluster sets `storage_encrypted=True`.

For Aurora, storage encryption is a cluster-level property. Per the CloudFormation documentation for `AWS::RDS::DBInstance.StorageEncrypted`, encryption for Aurora DB instances is managed by the DB cluster, so cluster member instances are expected not to carry `StorageEncrypted`. The rule flags them regardless, which makes every encrypted Aurora cluster synth with a warning, and fails synthesis for apps that run `cdk synth --strict`.

### Regression Issue

- [x] Select this option if this issue appears to be a regression.

Worked before the CloudFormation Validate default rules were introduced (2.262.0); pipelines running `cdk synth --strict` against unpinned aws-cdk-lib started failing with no code change.

### Last Known Working CDK Library Version

2.261.x

### Expected Behavior

No `W9008` finding for instances that belong to an Aurora `DatabaseCluster` with `storage_encrypted=True` (or to any Aurora cluster, since the property is not applicable at instance level).

### Current Behavior

```
WARNING RDS instance should have StorageEncrypted set to true (CloudFormation Validate)
MyStack/AuroraCluster/writer/Resource (AuroraClusterwriter...) aws-cdk-lib.aws_rds.CfnDBInstance
Suggested fix: Set StorageEncrypted to true
Acknowledge with 'CloudFormation-Validate::W9008'
Synthesis finished with warnings (--strict mode)
```

`cdk synth --strict` exits 1.

### Reproduction Steps

```python
from aws_cdk import App, Stack, aws_ec2 as ec2, aws_rds as rds

app = App()
stack = Stack(app, "MyStack")
vpc = ec2.Vpc(stack, "Vpc")

rds.DatabaseCluster(
stack,
"AuroraCluster",
engine=rds.DatabaseClusterEngine.aurora_postgres(
version=rds.AuroraPostgresEngineVersion.VER_16_4
),
vpc=vpc,
serverless_v2_min_capacity=0.5,
serverless_v2_max_capacity=2.0,
writer=rds.ClusterInstance.serverless_v2("writer"),
storage_encrypted=True,
)

app.synth()
```

Run `cdk synth --strict`.

### Possible Solution

Skip the `W9008` check for `AWS::RDS::DBInstance` resources that reference a `DBClusterIdentifier`, or evaluate the rule against the owning `AWS::RDS::DBCluster`'s `StorageEncrypted` instead.

### Additional Information/Context

Workaround that unblocks `--strict` pipelines, scoped to the cluster:

```python
from aws_cdk import Acknowledgment, Validations

Validations.of(cluster).acknowledge(
Acknowledgment(
id="CloudFormation-Validate::W9008",
reason="Aurora encryption is configured at cluster level (storage_encrypted=True).",
)
)
```

### CDK CLI Version

2.1132.1 (build 237e1b2)

### Framework Version

aws-cdk-lib 2.262.0

### Node.js Version

24.18.0

### OS

macOS 15 (also reproduced on Linux CI runners)

### Language

Python

### Language Version

3.12

Start by locating the built-in CloudFormation Validate rule W9008 and run the provided Python Aurora reproduction with cdk synth --strict. Confirm that Aurora DB instances linked by DBClusterIdentifier do not produce W9008 when cluster encryption is enabled, and add regression coverage for the corrected behavior.

Written by the indexing model from the issue text.