[custom-resources] Allow passing a Secret value as a parameter to `AwsCustomResource`

It would be convenient to be able to pass a secret `{{resolve}}` token as a parameter to the `AwsCustomResource` class and have it resolved at runtime to the actual secret value.

### Use Case

I created a custom resource that looked like this:

```ts
const systemUser = new cognito.CfnUserPoolUser(this, "CognitoSystemUser", {
username: 'myUser',
userPoolId: 'myUserPoolId',
});
const cognitoUserSecret = new secrets.Secret(this, "CognitoSystemUserSecret", {
secretName: `auth/internal/MySystemUser`,
generateSecretString: {
secretStringTemplate: JSON.stringify({
Username: user.username,
UserPoolId: user.userPoolId,
ClientId: 'myclientid',
}),
generateStringKey: "Password",
},
});
const customResource = new cr.AwsCustomResource(this, "CognitoSystemUserPasswordSetter", {
onCreate: {
service: "CognitoIdentityServiceProvider",
action: "adminSetUserPassword",
parameters: {
Username: systemUser.username,
UserPoolId: systemUser.userPoolId,
Password: cognitoUserSecret.secretValueFromJson("Password").toString(),
Permanent: true,
},
physicalResourceId: cr.PhysicalResourceId.of(`${systemUser.username}-password-confirmation`),
},
policy: cr.AwsCustomResourcePolicy.fromStatements([
new iam.PolicyStatement({
sid: "AllowSetPasswordForUser",
effect: iam.Effect.ALLOW,
actions: ["cognito-idp:AdminSetUserPassword"],
resources: [
cdk.Arn.format(
{
region: "us-west-2",
service: "cognito-idp",
resource: "userpool",
sep: "/",
resourceName: systemUser.userPoolId,
},
this,
),
],
}),
]),
});
cognitoUserSecret.grantRead(customResource);
```

This **almost** works, but it does not actually resolve the password to its value in Secrets Manager. In my case, it set the actual password to the literal string `{{resolve:secretsmanager:arn:aws:secretsmanager:us-west-2:123456789:secret:auth/internal/MySystemUser-ABCDEF:SecretString:Password::}}`.

### Proposed Solution

It would be great if the custom resource code looked for `{{resolve:secretsmanager}}`-style references in the `parameters` passed to `AwsCustomResource` and resolved them to their underlying value.

### Other

* [x] :wave: I may be able to implement this feature request
* [ ] :warning: This feature might incur a breaking change

---

This is a :rocket: Feature Request

Start by tracing how AwsCustomResource handles its parameters and how Secret.secretValueFromJson() is rendered into the custom resource request. Confirm the runtime path for {{resolve:secretsmanager}} references and define tests showing that the underlying secret value is supplied to the AWS action rather than the literal token.

Written by the indexing model from the issue text.