Add lambda-microvm-custom-domain-cdk pattern

[tanfrank]

Adds a new pattern: Custom domains for AWS Lambda MicroVMs with Application Load Balancer.

Each Lambda MicroVM is served under a domain you own (e.g. .microvms.example.com)
instead of the service-generated .lambda-microvm..on.aws endpoint. Built
entirely from load-balancing/networking primitives — no CloudFront and no compute in the
request path: an ALB rewrites the Host header (host-header-rewrite Transform) and forwards
to the MicroVM service over PrivateLink, with a wildcard ACM cert and Route 53 wildcard record.

Framework: AWS CDK v2 (TypeScript)
Includes: README.md, example-pattern.json, cdk.json, source, and passing tests (13/13).
The optional demo layer (single-page app + provisioning API) can be removed to deploy the
pure networking pattern.

[tanfrank]

Pushed a commit addressing all the feedback:

Service names qualified — Corrected Route53 → Route 53 throughout the stack, demo construct, tests, and comments, and tightened the pattern description to consistently use the full service names (AWS Lambda, Application Load Balancer, PrivateLink).

Lambda runtime bumped to Node 22 — The demo provisioning function moved from NODEJS_20_X to NODEJS_22_X (Node 20 is on the deprecation path).

Demo IAM scoped down — The provisioning Lambda's MicroVM permissions are now least-privilege per Lambda's actual IAM authorization model:

• RunMicrovm, GetMicrovm, and CreateMicrovmAuthToken are authorized on the MicroVM image resource (the only MicroVM resource type that exists in the model — there is no per-MicroVM ARN), so they're now scoped to the single microvmImageArn instead of *. This also implicitly pins them to the account and Region carried in the ARN.
• ListMicrovms is declared with no resource ARN in the authorization model, so it must remain on Resource: "*" — a narrower ARN would match nothing and deny the call. It's already implicitly account-scoped (a role only lists its own account's MicroVMs).

Unit tests were updated to assert the new policy shape (13/13 passing).

Verified end to end — Deployed the pattern to a test account and smoke-tested the full flow: demo page (HTTP 200, TLS), CORS preflight (204), POST /api/provision (launches a MicroVM + mints a JWE token), and — the core of the pattern — a request to the per-MicroVM custom domain routing through the ALB Host-header rewrite over PrivateLink to the MicroVM origin, which returned 200 pong.

[bfreiberg]

Looks good, thanks for your contribution. Your pattern will be merged soon