feat(lambda): add s3 object storage mode

[antespajic]

Issue # (if applicable)

Closes #38260.

Reason for this change

Lambda supports self-managed S3 code storage through S3ObjectStorageMode, but the Lambda L2 constructs did not expose it. Customers had to use L1 escape hatches to configure functions and layers to reference code directly from their own S3 bucket.

Description of changes

Add S3ObjectStorageMode and expose s3ObjectStorageMode on Code.fromBucketV2() options. The setting is carried through CodeConfig and rendered into both CfnFunction.CodeProperty.s3ObjectStorageMode and CfnLayerVersion.ContentProperty.s3ObjectStorageMode.

REFERENCE requires an S3 object version, so S3CodeV2 now validates that objectVersion is set for that mode. This covers both Code.fromBucketV2() and direct new S3CodeV2(...) usage.

The generated L1 model already contains s3ObjectStorageMode for Function and LayerVersion, so this does not use addPropertyOverride. cloudformation-validate still lags the generated L1 model for this property, so the validator plugin ignores only the two exact Lambda F3002 diagnostics instead of adding a broad construct-level acknowledgement.

Describe any new or updated permissions being added

No new permissions are automatically added by the L2 API. When using S3ObjectStorageMode.REFERENCE, the source bucket policy must allow the Lambda service principal to read the referenced object/version; the README and integ test show this requirement.

Description of how you validated changes

• NX_DAEMON=false npx lerna run build --scope=aws-cdk-lib --stream
• npx jest aws-lambda/test/code.test.ts aws-lambda/test/function.test.ts aws-lambda/test/layers.test.ts --coverage=false
• npx integ-runner --language javascript --directory test/aws-lambda/test integ.lambda-s3-object-storage-mode.js --dry-run --update-on-failed --force --strict
• git diff --check HEAD^ HEAD

Checklist

• My code adheres to the CONTRIBUTING GUIDE and DESIGN GUIDELINES

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license