MI-331: Add optional IP allowlist to SecureRestApi

[toddhainsworth]

Summary

• Add optional allowedIps prop to SecureRestApi (IPv4/IPv6 addresses or CIDR ranges)
• Enforced with an API Gateway resource policy: Allow execute-api:Invoke, Deny when aws:SourceIp is not in the list
• Entries are validated at synth with node:net; an empty array or any malformed entry throws, naming every bad value
• Omitting the prop leaves behaviour unchanged (no resource policy)

Notes

• The Deny applies to CORS preflight (OPTIONS) too, documented in the README
• 0.0.0.0/0 and ::/0 are accepted but disable the restriction
• Chose a prop over an aspect: it configures a single construct. A shared policy helper could back an aspect later if we want to enforce this across all RestApis
• A test confirms changing the list changes the Deployment logical ID, so the policy is redeployed

Changeset

@aligent/cdk-secure-rest-api: minor

[crispy101]

LGTM