Unable to use cross-account token lambda authorizer with SAM template

**Description:**

We have 2 AWS accounts, let's say account A and account B. Account A contains a lambda authorizer we want to use in Account B with API Gateway as a token authorizer. Using the classic cloud formation template, we will be able to create the authorizer reference in account B, and it will not attempt to modify the authorizer in account A to update its resource-based policy to allow cross-account access. The CFT deployment will be able to complete without problems.

However, using SAM syntax like below will cause the CFT deployment to fail:
```
# template.yaml, intended to be deployed in Account B
TestAuthServiceGateway:
Type: AWS::Serverless::Api
Properties:
StageName: !Ref Environment
OpenApiVersion: '3.0.0'
Auth:
DefaultAuthorizer: MyAuthorizerInAccountA
Authorizers:
MyAuthorizerInAccountA:
FunctionArn: arn:aws:lambda:us-west-2::function:dev-us-west-2-StandardAuthorizer
FunctionPayloadType: 'TOKEN'
Identity:
ReauthorizeEvery: 0 # disable cache
ValidationExpress: ^Bearer [a-zA-Z0-9\-_]+?\.[a-zA-Z0-9\-_]+?\.([a-zA-Z0-9\-_]+)?$
```
The reason is the user who triggered this deployment is currently in Account B and does not have permission to modify the authorizer in Account A.

The error CFT gives looks like below:
```
User: arn:aws:iam:::user/CICD is not authorized to perform: lambda:AddPermission on resource: arn:aws:lambda:us-west-2::function:dev-us-west-2-StandardAuthorizer (Service: AWSLambda; Status Code: 403; Error Code: AccessDeniedException; Request ID: 964a7be1-fb95-4759-8c2d-11476c74630b)
```

My questions are:
1. Is there a way to setup IAM role/policy/trust relationship, such that user in Account B, at cloudformation deployment time, can have the permission to modify cross-account authorizer's resource-based policy? This [wiki](https://docs.amazonaws.cn/en_us/lambda/latest/dg/access-control-resource-based.html) does not suggest "lambda:AddPermission" is a supported API in resourced-based policy. I also gave it a try, and could not get it to work.
2. Is it possible to suggest a feature request that do not set the authorizer's resource policy at deployment time? And assume it's already done outside out cloud formation? (This is a one-time thing either way). Something similar to this "[AddDefaultAuthorizerToCorsPreflight](https://docs.aws.amazon.com/serverless-application-model/latest/developerguide/sam-property-api-apiauth.html#sam-api-apiauth-adddefaultauthorizertocorspreflight)" flag?

**Steps to reproduce the issue:**
1. Create an lambda authorizer in Account A
2. Trying to deploy a SAM template in Account B referencing the token authorizer in Account A
3. See the failure in cloud formation saying it does not have permission to modify the resource-based policy of authorizer

**Observed result:**
Unable to modify authorizer resource-based policy in Account A

**Expected result:**
Able to modify given appropriate cross-account permission setup, or allow disable this step of updating the authorizer's resource policy.

_**Update:**_
Looked into code [here](https://github.com/awslabs/serverless-application-model/blob/c5221fcf732475bcc59c5238f963dc95c0033729/samtranslator/model/api/api_generator.py#L847), can we update the logic here such that we only attempt to update authorizer's resource based policy when the authorizer lives in the same AWS account? Maybe just update this logic [here](https://github.com/awslabs/serverless-application-model/blob/c5221fcf732475bcc59c5238f963dc95c0033729/samtranslator/model/api/api_generator.py#L887) that also skip when the AWS account of the authorizer.function_arn does not contain the current AWS account ID?