CDK construct validation error when trying use SSM Secure string reference - related to userpool identity provider

I'm trying to setup a user pool with okta secrets which are stored in ssm parameter store as secured strings.
I'm able to get the tokens as described here:
https://docs.aws.amazon.com/cdk/latest/guide/get_ssm_value.html#ssm_read
and i call the following function in a construct with these tokens:
aws_cognito.CfnUserPoolIdentityProvider

however, i get a cdk construct validation error:
SSM Secure reference is not supported in: [AWS::Cognito::UserPoolIdentityProvider/Properties/ProviderDetails/client_secret,AWS::Cognito::UserPoolIdentityProvider/Properties/ProviderDetails/client_id]

When I change the parameter type to just string (not secured), it works.
However, this is a big problem since this is an a client secret, stored as plaintext.

### Proposed Solution

Implement the ability to use secured strings in this use-case :)

* [ ] :wave: I may be able to implement this feature request
* [ ] :warning: This feature might incur a breaking change

---

This is a :rocket: Feature Request

Start with the aws_cognito.CfnUserPoolIdentityProvider construct and the CDK validation that reports unsupported SSM Secure references for ProviderDetails.client_secret and client_id. Review how the documented SSM token is passed into those properties and determine the supported implementation scope; done means secure-string references work there without exposing the client secret as plaintext.

Written by the indexing model from the issue text.