core: CloudFormation-Validate::E3023 false positive when an IP address is a token

### Describe the bug

`CloudFormation-Validate::E3023` is reported when a route53 RecordSet's IP address is a token (`Fn::GetAtt` or `Ref`).

``` ts
const eip = new ec2.CfnEIP(this, 'EIP', { instanceId: instance });
new route53.ARecord(this, 'ARecord', {
zone,
target: route53.RecordTarget.fromIpAddresses(eip.attrPublicIp),
});
```

> WARNING ResourceRecords.0: 'EC2EIP77649D11' is not a valid IPv4 address for record type 'A' (CloudFormation Validate)
> ... aws-cdk-lib.aws_route53.CfnRecordSet
> Acknowledge with 'CloudFormation-Validate::E3023'

Template:
``` json5
{
"EC2ARecord12AB23B6": {
"Type": "AWS::Route53::RecordSet",
"Properties": {
"HostedZoneId": "xxxxxxxx",
"Name": "xxxxxxxx",
"ResourceRecords": [
{
"Fn::GetAtt": [
"EC2EIP77649D11",
"PublicIp"
]
}
],
"TTL": "300",
"Type": "A"
},
},
}
```

Same warning is reported when the intrinsic function is `Ref` instead.

> WARNING ResourceRecords.0: '' is not a valid IPv4 address for record type 'A' (CloudFormation Validate)
> ... aws-cdk-lib.aws_route53.CfnRecordSet
> Acknowledge with 'CloudFormation-Validate::E3023'

### Regression Issue

- [ ] Select this option if this issue appears to be a regression.

### Last Known Working CDK Library Version

_No response_

### Expected Behavior

No warnings are reported.

### Current Behavior

See the description above.

### Reproduction Steps

See the description above.

### Possible Solution

_No response_

### Additional Information/Context

_No response_

### AWS CDK Library version (aws-cdk-lib)

2.262.2

### AWS CDK CLI version

2.1134.0 (build d87457e)

### Node.js Version

v24.18.0

### OS

Linux

### Language

TypeScript

### Language Version

_No response_

### Other information

_No response_

Start with the aws_route53.CfnRecordSet entry point and the CloudFormation-Validate::E3023 handling for ResourceRecords. Reproduce the warning using the shown Ref and Fn::GetAtt templates, then inspect existing validation coverage. Done means token-valued A records no longer produce the invalid IPv4 warning while literal IP validation remains covered.

Written by the indexing model from the issue text.