feat(aws-certificatemanager): add DnsValidatedCertificateV2

[garysassano]

Reason for this change

Adds DnsValidatedCertificateV2 for public ACM certificates in a chosen region, including us-east-1 for CloudFront applications deployed from another region. Certificates and cross-stack ARN references use native CloudFormation, without certificate-provider Lambdas or custom resources.

Description of changes

• Placement: Defaults to the containing stack, including environment-agnostic stacks. Use certificateRegion for regional placement or certificateStack for an explicit owner's region and lifecycle; these inputs are mutually exclusive.
• DNS validation: Supports a public Route 53 zone in the certificate account or exact primary/SAN mappings through hostedZonesByDomain, with name normalization, lazy SAN support, and focused validation errors.
• References: Top-level owners use weak Fn::GetStackOutput references for consumers in other stack trees. Nested owners support consumers within their top-level stack tree; external sharing fails at synthesis with guidance to use a top-level owner.
• CDK integration: Implements ICertificate with standard tagging, expiry metrics, lifecycle controls, and a public certificateResource escape hatch. Includes module/API documentation and an integration fixture.

Compatibility

Library-wide minimums increase to aws-cdk-lib 2.268.0, constructs 10.8.1, and Node.js 22. The separate foundation commit also updates jsii/TypeScript to 6 and CI to Node.js 24, including an FSx KMS reference compatibility adjustment. These minimums and their release impact need maintainer agreement.

Description of how you validated changes

Validated commit 4e5adfb8b6cc1bb4fd8688b92ea463ce9994fd38:

• npm run build: 434 tests passed in 13 suites, including 194 ACM tests, plus ESLint, jsii compilation, API generation, and JavaScript/Python packaging.
• Packaged JavaScript/TypeScript and Python consumers passed at the declared peer minimums, including supported and rejected sharing from nested owners. All four README examples compiled and synthesized.
• Offline integration synthesis verified the certificate ARN output consumed by CloudFront, deployment dependency, and provider absence. Five placement identity fixtures remained unchanged.

ACM coverage is 99.19% statements/lines, 98.39% branches, and 100% functions. Uncovered defensive paths guard an unexpected ACM default child and a changed readonly region on a generated owner.

Integration evidence

Commit 4e5adfb passed the scoped AWS integration test on 2026-09-06: ACM issued the certificate in us-east-1, CloudFront deployed from eu-central-1 with the expected viewer ARN, and both deployed assertions passed. Independent service checks confirmed the issued certificate, deployed distribution, and native cross-region reference in the deployed templates. The runner-generated snapshot comparison passed unchanged.

Cleanup was independently verified: all three test stacks, the certificate, distribution, assertion Lambda/IAM role, and assertion log group were removed; DNS records exactly match the pre-run state. The original snapshot contains personal fixture identifiers and remains private. A publishable snapshot or maintainer-accepted alternative remains outstanding.

Checklist

• My code adheres to the CONTRIBUTING GUIDE
• My pull request adheres to the Pull Request Rule

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license