custom-resources: add refresh trigger property to AwsCustomResource

### Describe the feature

Add an optional property to AwsCustomResource whose only purpose is to participate in CloudFormation change detection.

When the value of this property changes, CloudFormation would send an Update event to the custom resource, causing the configured onUpdate SDK call to run again.

The property would not be passed to the AWS SDK call itself.

For example:

```
new AwsCustomResource(this, 'Resource', {
onUpdate: {
service: 'SomeService',
action: 'someAction',
parameters: {
// ...
},
physicalResourceId: PhysicalResourceId.of('Resource'),
},
updateTrigger: someParameter.valueAsString,
policy: AwsCustomResourcePolicy.fromSdkCalls({
resources: AwsCustomResourcePolicy.ANY_RESOURCE,
}),
});
```

### Use Case

There are cases where an AwsCustomResource needs to rerun its onUpdate call because some external deployment input changed, even though that input is not itself a parameter to the AWS SDK operation.

For example, an SSM parameter, configuration version, hash, or another resource attribute may determine when the SDK call should be refreshed.

### Proposed Solution

_No response_

### Other Information

Would be happy to make a pull request if the maintainers are happy with this feature.

### Acknowledgements

- [x] I may be able to implement this feature request
- [ ] This feature might incur a breaking change

### AWS CDK Library version (aws-cdk-lib)

2.269.0

### AWS CDK CLI version

2.1141.0

### Environment details (OS name and version, etc.)

Not relevant

Start by locating the AwsCustomResource entry point and tracing how its CloudFormation properties and onUpdate SDK call are configured. Done means changing the optional refresh value causes a CloudFormation Update event and reruns onUpdate, while the value itself is not passed to the AWS SDK operation.

Written by the indexing model from the issue text.