feat(codepipeline-actions): cdk support for service role override field in codebuild actions

### Describe the feature

Add a serviceRoleOverride prop to CodeBuildAction (maps to CodePipeline's ServiceRoleArnOverride), and add functionality to auto create the role behind a feature flag.

### Use Case

This field was already added to codepipeline and is lacking CDK support.

### Proposed Solution

- New optional CodeBuildAction.serviceRoleOverride: IRole → emits ServiceRoleArnOverride; pipeline role gets scoped iam:PassRole.
- New ApiDefault-style feature flag @aws-cdk/aws-codepipeline-actions:autoScopeCodeBuildRoleForFullClone. When enabled and no override is given, and the action has CodeConnections Full Clone inputs, auto-create a scoped role (exposed as buildAction.serviceRole), with UseConnection conditioned on FullRepositoryId for exactly the cloned repos.

Service role selection:
- Explicit serviceRoleOverride → that role
- Flag enabled + Full Clone source → auto-created scoped role
- Otherwise → the CodeBuild project's default service role (unchanged)

### Other Information

_No response_

### Acknowledgements

- [x] I may be able to implement this feature request
- [ ] This feature might incur a breaking change

### AWS CDK Library version (aws-cdk-lib)

2.266.0

### AWS CDK CLI version

2.1131.0 (build 1e9a1e1)

### Environment details (OS name and version, etc.)

OS: macOS (Darwin 25.6.0), arm64, Node.js: 24.18.0

Start at the CodeBuildAction implementation and trace how CodePipeline action properties, CodeConnections Full Clone inputs, and service roles are currently handled. Compare the requested ServiceRoleArnOverride mapping and feature-flag behavior with existing role and permission logic. Done means explicit overrides, automatic scoped roles for eligible Full Clone actions, and unchanged default behavior are covered by tests.

Written by the indexing model from the issue text.