feat(cloudfront): default Distribution behaviors to redirect HTTP to HTTPS

## Describe the feature

Change the default `viewerProtocolPolicy` for `Distribution` behaviors from `ViewerProtocolPolicy.ALLOW_ALL` to `ViewerProtocolPolicy.REDIRECT_TO_HTTPS` for new CDK projects.

## Use Case

A behavior with no explicit viewer protocol policy currently accepts HTTP. New distributions should redirect viewers to HTTPS by default.

## Proposed Solution

Add an `ApiDefault` feature flag, for example `@aws-cdk/aws-cloudfront:defaultViewerProtocolPolicyRedirectToHttps`.

- Recommended value: `true`
- Unconfigured behavior: `false`
- Flag enabled default: `REDIRECT_TO_HTTPS`
- Flag disabled default: `ALLOW_ALL`
- An explicit `viewerProtocolPolicy` always wins

Apply this to default and additional behaviors. Existing applications retain `ALLOW_ALL` unless they enable the flag.

## Acknowledgements

- [x] I may be able to implement this feature request
- [x] This feature might incur a breaking change

## AWS CDK Library version

main (`ccd263359f`)

## AWS CDK CLI version

N/A

## Environment details

macOS 26.5.1

Start at the CloudFront Distribution behavior defaults and existing ApiDefault feature-flag handling. Trace both default and additional behaviors, confirming that the flag selects REDIRECT_TO_HTTPS or ALLOW_ALL, existing applications retain the legacy default when unconfigured, and an explicit viewerProtocolPolicy takes precedence.

Written by the indexing model from the issue text.