Expose Cloudfront configuration for private construct hub

Users wishing to deploy private instances of construct hub may want to put some sort of authorization in front of their cloudfront distribution in order to prevent access outside of their organization. In order to aid this we should allow passing in custom configuration to all relevant cloudfront properties from the top level construct. Notably this may require customization to the `defaultBehavior` and `additionalBehaviors`.

There may be more ergonomic ways to allow access to known verification workflows without requiring users to configure their own behaviors by overriding the existing ones.