Add at least 1 CDK-added "default" validation rule (info inside)

Theoretically we now have the ability to write certain validation rules in Rego, and load those into the CloudFormation Validate validator.

Write at least one such rule, load it, and ship it with the CDK.

* Take any L2 validation that we currently add in CDK code and add a checker for it in Rego. Use a rarely-used construct library.
* Write developer guide documentation for how to do this.
* Demo this in a cross-team meeting.