CloudFront config option to opt-out of updating origin bucket policy when passing OAI

In the AWS console you can choose option for CloudFront to *not* update origin s3 bucket policy with read permissions.

The CDK Cloudfront tries to update bucket policy without giving an option to opt-out.
Here is the related code.
https://github.com/aws/aws-cdk/blob/b3abc681b97a385be83c6efd2fe3e6eb57933e77/packages/%40aws-cdk/aws-cloudfront/lib/web_distribution.ts#L702

```javascript
if (originConfig.s3OriginSource) {
// first case for backwards compatibility
if (originConfig.s3OriginSource.originAccessIdentity) {
// grant CloudFront OriginAccessIdentity read access to S3 bucket
originConfig.s3OriginSource.s3BucketSource.grantRead(originConfig.s3OriginSource.originAccessIdentity);

s3OriginConfig = {
originAccessIdentity:
`origin-access-identity/cloudfront/${
originConfig.s3OriginSource.originAccessIdentity.originAccessIdentityName
}`
};
} else {
s3OriginConfig = {};
}
}
```

### Use Case

We have a use case were we need manage the bucket policy specifically for our automation to work properly.

### Proposed Solution

Is it possible to pass a flag on S3OriginConfig interface, something like -

```javascript
const distibutionConfig: CloudFrontWebDistributionProps = {
webACLId,
originConfigs: [
{

s3OriginSource: {
s3BucketSource: bucket,
originAccessIdentity,
updateBucketPolicy: false // true by default
},
behaviors: [{ isDefaultBehavior: true }]
}
],
aliasConfiguration
};

.......
......
# web_distribution.ts

if (originConfig.s3OriginSource) {
// first case for backwards compatibility
if (originConfig.s3OriginSource.originAccessIdentity ) {
if(originConfig.s3OriginSource.updateBucketPolicy) {
// grant CloudFront OriginAccessIdentity read access to S3 bucket
originConfig.s3OriginSource.s3BucketSource.grantRead(originConfig.s3OriginSource.originAccessIdentity);
}

......
......

```

* [x] :wave: I may be able to implement this feature request
* [ ] :warning: This feature might incur a breaking change

---

This is a :rocket: Feature Request

Start with the linked origin-handling code in packages/@aws-cdk/aws-cloudfront/lib/web_distribution.ts and locate the S3OriginConfig interface used by it. Trace how the existing originAccessIdentity path grants bucket access, then add the opt-out behavior and verify that the default remains unchanged with relevant CloudFront tests.

Written by the indexing model from the issue text.