feat: show early validation errors on deploy

[otaviomacedo]

CloudFormation has recently launched early validation. When creating the change set, CloudFormation validates a few things such as whether the deploy would try to create resources with existing physical IDs. More validations to come. But the specific information about the error (other than it's an early validation error) is not returned by the DescribeChangeSet API. The consumer is supposed to call a new API, DescribeEvents to get that information.

Introduce a new class,EarlyValidationReporter that checks whether such an error occurred and call the DescribeEvents API. The bootstrap stack was also updated to include permission to this new API.

If the role being used for deployment doesn't have permission to call DescribeEvents, the toolkit will warn the user that it cannot show the proper error message, and suggest a re-bootstrap.

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 87.38%. Comparing base (2a6f8d3) to head (54a6f82).

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #970   +/-   ##
=======================================
  Coverage   87.38%   87.38%           
=======================================
  Files          71       71           
  Lines       10010    10010           
  Branches     1311     1311           
=======================================
  Hits         8747     8747           
  Misses       1240     1240           
  Partials       23       23           

Flag	Coverage Δ
suite.unit	87.38% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[github-actions]

⚠️ Bootstrap Template Protection

This PR modifies the bootstrap template (packages/aws-cdk/lib/api/bootstrap/bootstrap-template.yaml), which requires special protections.

✅ All requirements met! This PR can proceed with normal review process.

Requirements

Version Increment
✅ Version incremented from 29 to 30

Security Review
✅ Review completed (PR has pr/security-reviewed label)

Why these protections exist

• The bootstrap template contains critical infrastructure
• Changes can affect IAM roles, policies, and resource access across all CDK deployments
• Version increments ensure users are notified of updates