Cross-Account SMUS/DataZone Project Membership fails due to missing datazone:GetGroupProfile permission for custom-resource lambda

When deploying a DataOps-Project with sagemaker domain settings in a workload account that references a DataZone domain in a hub account, the creation of group memberships fails. The native CloudFormation resource AWS::DataZone::ProjectMembership requires the
ability to call datazone:GetGroupProfile on the Hub domain to resolve group identifiers.

In a cross-account scenario, even if the workload account's CDK role has identity-based permissions, the Hub account's SMUS/DataZone Domain resource-based policy must explicitly allow the workload account's CloudFormation execution role to perform this action.

Currently, @aws-mdaa/datazone-l3-construct (v1.5.0) does not configure the DataZone Domain resource policy to allow these cross-account read actions.

**Error Message**

```
Resource handler returned message: "User: arn:aws:sts::WORKLOAD_ACCOUNT:assumed-role/cdk-hnb659fds-cfn-exec-role-WORKLOAD_ACCOUNT-REGION/AWSCloudFormation not authorized to perform: datazone:GetGroupProfile on resource: arn:aws:datazone:REGION:HUB_ACCOUNT:domain/dzd-xxxxxxxxxxxx because no resource-based policy allows the datazone:GetGroupProfile action" (Service: DataZone, Status Code: 403, HandlerErrorCode: AccessDenied)

abc-test-wkld-ops-dataops: deploying... [1/1]
4:33:33 PM | CREATE_FAILED | AWS::DataZone::ProjectMembership | constructsagemaker...ataanalyst4582FD9A
Resource handler returned message: "User: arn:aws:sts:::assumed-role/cdk-hnb659fds-cfn-exec-role--ca-central-1/AWSCloudFormation is not authorized to perform: datazone:GetGroupProfile on
resource: arn:aws:datazone:ca-central-1::domain/dzd-XXXXXXXXX because no resource-based policy allows the datazone:GetGroupProfile action (Service: DataZone, Status Code: 403, Request ID: cc9ae
e50-1063-46fc-bec9-e5fa4c866e22) (SDK Attempt Count: 1)" (RequestToken: 5fc1055d-5566-f069-81f7-9cc6748d9606, HandlerErrorCode: AccessDenied)
```

**Root Cause Analysis**
1. Native Resource Requirement: The `AWS::DataZone::ProjectMembership` resource (specifically when adding Group members via SSO IDs) triggers an internal call to GetGroupProfile.

---

Impacted Modules/Versions
* @aws-mdaa/datazone-l3-construct v1.5.0
* @aws-mdaa/sagemaker v1.5.0
* @aws-mdaa/dataops-project (and any module using MdaaDatazoneProject.addMembership)

---

Related MDAA config files:

## MDAA.yaml
#### HUB ACCOUNT - SMUS Domain & Governance
```
hub-gov:
environments:
test:
account: "{{context:hub_account}}"
modules:
# SageMaker Unified Studio domain
smus-dom:
module_path: "@aws-mdaa/sagemaker"
module_configs:
- ./hub/smus-domain.yaml
additional_accounts:
- "{{context:workload_account}}"

smus-prof:
module_path: '@aws-mdaa/sagemaker-project'
module_configs:
- ./hub/smus-project-profiles.yaml
```

#### WORKLOAD ACCOUNT - DataOps (projects, crawlers, workflows, athena)
```
wkld-ops:
environments:
test:
account: "{{context:workload_account}}"
modules:

# Main DataOps project with all CoT databases
dataops:
module_path: "@aws-mdaa/dataops-project"
module_configs:
- ./workload/dataops-project.yaml
```

## DATAOPS-PROJECT.yaml

```
dataAdminRoles:
- id: ssm-org:/wkld-com/generated-role/data-admin/id
projectExecutionRoles:
- id: ssm-org:/wkld-com/generated-role/glue-etl/id
dataEngineerRoles:
- id: ssm-org:/wkld-com/generated-role/data-engineer/id

s3OutputKmsKeyArn: ssm-org:/wkld-lake/datalake/kms/arn
glueCatalogKmsKeyArn: ssm-org:/wkld-com/glue-cat/kms/arn

sagemaker:
domainConfigSSMParam: arn:aws:ssm:ca-central-1:{{context:hub_account}}:parameter/tvn-mdaa/hub-gov/smus-dom/domain/tdp-hub/config

project:
profileName: pr-dae-profile
ownerGroups:
pr-dae-data-admin: "{{context:pr_dae_admin_group_sso_id}}"
groups:
pr-dae-data-engineer: "{{context:pr_dae_engineer_group_sso_id}}"
pr-dae-data-analyst: "{{context:pr_dae_analyst_group_sso_id}}"
domainUnit: /domain-unit-level1/domain-unit-level2

databases:

my_db_raw:
locationBucketName: ssm-org:/wkld-lake/datalake/bucket/raw/name
locationPrefix: mysource/mydb/myschema
verbatimName: true
lakeFormation:
createSuperGrantsForDataAdminRoles: true
createReadGrantsForDataEngineerRoles: true
createReadWriteGrantsForProjectExecutionRoles: true
```