yarn.lock resolves vulnerable fast-xml-parser 4.4.1 via stale @aws-sdk/client-lambda pin (not shipped to users)

### Describe the bug

`packages/@aws-cdk/custom-resource-handlers` depends on `@aws-sdk/client-lambda@3.632.0`, which transitively pulls in `@aws-sdk/client-sts` / `@aws-sdk/client-sso-oidc` / `@aws-sdk/core@3.629.0`, which pins `fast-xml-parser` to the exact version `4.4.1`. This version is vulnerable to [GHSA-m7jm-9gc2-mpf2](https://github.com/advisories/GHSA-m7jm-9gc2-mpf2) (entity encoding bypass via regex injection in DOCTYPE entity names), fixed in `4.5.4`.

`@aws-sdk/client-lambda` is imported directly by two custom resource handlers:
- `packages/@aws-cdk/custom-resource-handlers/lib/triggers/lambda/index.ts` (used by the `Trigger` construct)
- `packages/@aws-cdk/custom-resource-handlers/lib/aws-synthetics/auto-delete-underlying-resources-handler/index.ts`

Both handlers are bundled (esbuild) and airlifted into `aws-cdk-lib` via `packages/aws-cdk-lib/scripts/airlift-custom-resource-handlers.sh`, so the vulnerable `fast-xml-parser` code ends up inlined into the compiled Lambda asset that gets deployed into a user's AWS account whenever these custom resources are used.

Note: this is **not** visible via `npm audit`/`yarn audit` on a downstream CDK app, because `@aws-sdk/client-lambda` (and therefore `fast-xml-parser`) is not listed in the published `aws-cdk-lib` `package.json` `dependencies` — it's only visible when auditing the `aws-cdk` source monorepo itself, or by unpacking the built package and scanning the bundled handler code directly. This is likely why it hasn't been picked up by the automated `yarn-upgrade` workflow or Dependabot yet.

### Regression Issue

- [ ] Select this option if this issue appears to be a regression.

### Last Known Working CDK Library Version

_No response_

### Expected Behavior

Bundled custom resource handler code should not ship with library versions that have known CVEs.

### Current Behavior

Running `yarn audit` against the `aws-cdk` repository (main branch) reports a `critical` severity finding:

```
fast-xml-parser >=4.1.3 <4.5.4
Severity: critical
fast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity names - https://github.com/advisories/GHSA-m7jm-9gc2-mpf2
fix available via `npm audit fix`
node_modules/fast-xml-parser
@aws-sdk/core >=3.0.0
Depends on vulnerable versions of fast-xml-parser
node_modules/@aws-sdk/core
@aws-sdk/client-sso-oidc
node_modules/@aws-sdk/client-sso-oidc
@aws-sdk/client-lambda
node_modules/@aws-sdk/client-lambda
```

Path (from `yarn audit --json`):
```
@aws-cdk/custom-resource-handlers>@aws-sdk/client-lambda>@aws-sdk/client-sso-oidc>@aws-sdk/core>fast-xml-parser
```

### Reproduction Steps

```
git clone https://github.com/aws/aws-cdk.git
cd aws-cdk
yarn install
yarn audit --json | grep -A2 '"module_name":"fast-xml-parser"'
```

The audit reports `fast-xml-parser@4.4.1` (vulnerable range `>=4.1.3 <4.5.4`) reachable through `packages/@aws-cdk/custom-resource-handlers`'s pinned `@aws-sdk/client-lambda@3.632.0` dependency chain, in addition to a separate (test-only, non-shipped) path through `@aws-cdk/integration-test-deployment`.

### Possible Solution

Force `fast-xml-parser` to a patched version (`>=4.5.4`) for the dependency chain used by `custom-resource-handlers`, e.g. by adding a `resolutions` entry to the root `package.json`:

```json
"resolutions": {
"fast-xml-parser": "^4.5.4"
}
```

and running `yarn install` to update `yarn.lock`, then rebuilding `custom-resource-handlers` so the bundled/airlifted Lambda assets pick up the patched version. Alternatively, bump the pinned `@aws-sdk/client-*` dependencies in `packages/@aws-cdk/custom-resource-handlers/package.json` (currently `3.632.0`, from August 2024) to a newer release that no longer depends on the vulnerable `fast-xml-parser` version.

### Additional Information/Context

Similar in nature to the recently fixed bundled-dependency CVEs in this repo (#38257, #38409 for `brace-expansion`), except this one is a *shipped Lambda asset* dependency rather than a build-tool dependency, so the fix needs to ensure the airlifted/bundled handler code is rebuilt with the patched dependency, not just the root `yarn.lock`.

### AWS CDK Library version (aws-cdk-lib)

2.262.1 (main branch, commit da35408de1)

### AWS CDK CLI version

N/A (found via source repository audit, not a deployed app)

### Node.js Version

v22.22.3

### OS

Linux (WSL2)

### Language

TypeScript

### Language Version

_No response_

### Other information

_No response_

Start with packages/@aws-cdk/custom-resource-handlers/package.json, the root package.json and yarn.lock, then run the provided yarn audit command to confirm the vulnerable dependency path. Review the two handler entry points and packages/aws-cdk-lib/scripts/airlift-custom-resource-handlers.sh; done means the lockfile and rebuilt airlifted Lambda assets no longer contain fast-xml-parser 4.4.1 and use a patched version.

Written by the indexing model from the issue text.