feat(cloudfront): default Distribution viewer security policy to TLSv1.2_2025

## Describe the feature

Change the default viewer security policy for `Distribution` from `SecurityPolicyProtocol.TLS_V1_2_2021` to `SecurityPolicyProtocol.TLS_V1_2_2025` for new CDK projects when `certificate` is configured.

## Use Case

`TLS_V1_2_2025` is available in the L2, but distributions with a configured certificate still default to the 2021 policy.

## Proposed Solution

Add an `ApiDefault` feature flag, for example `@aws-cdk/aws-cloudfront:defaultSecurityPolicyTLSv1.2_2025`.

Default selection should be:

1. Explicit `minimumProtocolVersion`
2. `TLS_V1_2_2025` when the new flag is enabled
3. `TLS_V1_2_2021` when the existing `defaultSecurityPolicyTLSv1.2_2021` flag is enabled
4. `TLS_V1_2_2019` otherwise

Use `recommendedValue: true` and `unconfiguredBehavesLike: { v2: false }` so existing applications remain unchanged.

## Acknowledgements

- [x] I may be able to implement this feature request
- [x] This feature might incur a breaking change

## AWS CDK Library version

main (`ccd263359f`)

## AWS CDK CLI version

N/A

## Environment details

macOS 26.5.1

Start at the CloudFront Distribution implementation and trace how viewer security policy defaults are selected when a certificate is configured. Read the existing defaultSecurityPolicyTLSv1.2_2021 feature flag handling, then verify the requested precedence and ApiDefault settings. Done means explicit values still win, the new flag selects TLS_V1_2_2025, and existing applications retain their current behavior.

Written by the indexing model from the issue text.