Security plugins not applied on a plain cdk deploy; plugin set is not configurable

## Problem

`applyWrapper()` (`packages/@cdklabs/cdk-cicd-wrapper/src/runtime/inject.ts`) applies the default-on security Aspects (AwsSolutionsChecks, LogRetentionAspect, EncryptBucketOnTransitAspect, EncryptSNSTopicOnTransitAspect, RotateEncryptionKeysAspect, DisablePublicIPAssignmentForEC2Aspect) in only two entry points:

1. the `-r register.js` preload armed by `cdk-cicd exec` (the `cdk.json` `app` command), and
2. the explicit `CdkCicd.attach(app)` escape hatch.

A plain `cdk deploy` whose `app` command does not route through `cdk-cicd exec`, and whose `bin/` does not call `CdkCicd.attach(app)`, gets **none** of these Aspects. There is also no supported way to add your own Aspects/plugins or to opt out of the built-in ones — the list is a literal inside `applyWrapper`.

## Goals

1. The security plugins apply on a normal deploy via the documented `bin/` entry point (`CdkCicd.attach(app)`), with an opt-out.
2. The plugin set is configurable: select/override the built-in list and register custom plugins.

## Proposed design

- Each plugin has `{ name, version }`. Built-ins live in an internal name→Aspect registry.
- `cicd.config.ts` gains `plugins?: { name, version }[]`: omitted → current defaults; `[]` → opt out of all; non-empty → **completely overrides** the default set. An unknown (custom) name must have a matching `CdkCicd.addPlugin(...)` in `bin/`, else synth fails with an actionable error.
- `bin/`: `CdkCicd.addPlugin(app, aspect, { name, version })` registers a custom instance; `CdkCicd.attach(app, { plugins?, skipDefaults? })` expresses override/opt-out in code (bundled/ESM apps).
- A pure, unit-tested `resolvePlugins(...)` is the single source of truth.

## Non-goals

- A new zero-touch preload launcher for a stock `bin/` (follow-up).
- Changing the six Aspects' behaviour.

## Verification

- Unit tests for `resolvePlugins`, `attach`/`addPlugin`, registry completeness.
- A meaningful-complexity sample app (API Gateway + Lambda + DynamoDB + SNS) deployed to a sandbox, proving the SNS HTTPS-only policy and bucket/key aspects fire on a normal deploy.
- A visual before/after report as proof.

Start with applyWrapper() in packages/@cdklabs/cdk-cicd-wrapper/src/runtime/inject.ts, then read the documented bin/ entry point, CdkCicd.attach(app), CdkCicd.addPlugin(...), and cicd.config.ts. Run or add the unit tests for resolvePlugins, attach/addPlugin, and registry completeness. Done means normal deploys apply the expected defaults, opt-out and overrides work, custom plugins fail clearly when unregistered, and the sample app verifies the listed security aspects.

Written by the indexing model from the issue text.