fix(cloudfront): warn when minimumProtocolVersion is set without a certificate

[tiwari91]

Issue

Closes #35404

Reason for this change

Setting minimumProtocolVersion or sslSupportMethod on a Distribution without also providing a custom certificate has no effect — the distribution silently falls back to the CloudFront default certificate, which uses a fixed security policy. Users have no way of knowing their TLS configuration is being ignored.

Description of changes

Added Annotations.of(this).addWarningV2() warnings in the Distribution constructor for both minimumProtocolVersion and sslSupportMethod when they're set without a certificate.

This follows the same pattern as the existing emptyDomainNames warning a few lines above.

Description of how you validated changes

Added three test cases:

• Warning emitted when minimumProtocolVersion is set without a certificate
• Warning emitted when sslSupportMethod is set without a certificate
• No warning when minimumProtocolVersion is set with a certificate present

All existing CloudFront tests pass (419 tests, 28 suites).

Checklist

• My code adheres to the CONTRIBUTING GUIDE and DESIGN GUIDELINES

[aws-cdk-automation]

The pull request linter fails with the following errors:

❌ Fixes must contain a change to an integration test file and the resulting snapshot.

If you believe this pull request should receive an exemption, please comment and provide a justification. A comment requesting an exemption should contain the text Exemption Request. Additionally, if clarification is needed, add Clarification Request to a comment.

✅ A exemption request has been requested. Please wait for a maintainer's review.

[tiwari91]

Exemption Request

This change only adds Annotations.addWarningV2() warnings in the Distribution constructor — it does not modify the synthesized CloudFormation template in any way. There are no resource property changes, no new resources, and no behavioral differences in the output. The warnings are purely informational and only surface during synth.

Unit tests covering the new warning assertions have been added.