feat(lambda): add grantInvokeLatestVersion to grant invoke only to la…

…test function version (#29856)

### Issue # (if applicable)

Closes #20177

### Reason for this change



`fn.grantInvoke()` will grant invoke permission to invoke both the latest version and all pervious version of the lambda function. We can see this behavior could bring some security concern for some of our customers.

### Description of changes



We provides a new function `fn.grantInvokeLatestVersion()`  to grant invoke only to the Latest version of function and the unqualified lambda arn

Example:
```ts
// Grant permissions to a service
declare const fn: lambda.Function;
const principal = new iam.ServicePrincipal('my-service');

fn.grantInvokeLatestVersion(principal);

```

### Description of how you validated changes


Added unit tests and integration tests.
When using `fn.grantInvokeLatestVersion()` granted principle to invoke a function's past version, it will get the following error:
```
An error occurred (AccessDeniedException) when calling the Invoke operation: User: {$principle} is not authorized to perform: lambda:InvokeFunction on resource: {$LambdaArn:$version} because no identity-based policy allows the lambda:InvokeFunction action
```

### Alternative design (to discuss)
setup a `grantInvokeProp` including `grantVersionAccess` flag to pass in the `grantInvokeLatestVersion` instead using `grantVersionAccess` flag directly on `grantInvokeLatestVersion`
-> This is discussed in the comments, I agree having props will have future extensibility but usually for grant methods specifically we haven't seen before. So we will not add prop to the new function `grantInvokeLatestVersion`

### Checklist
- [x] My code adheres to the [CONTRIBUTING GUIDE](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) and [DESIGN GUIDELINES](https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md)

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

packages/@aws-cdk-testing/framework-integ/test/aws-lambda/test/integ.permissions.js.snapshot/lambda-permissions.template.json

@@ -117,6 +117,20 @@
     "Principal": "apigateway.amazonaws.com"
    }
   },
+  "MyLambdaInvokeZQDUzUWqDuiGYFrGB6ik9uIPJSgF8GSLIg6NTO8jHPIBE1EB3A4": {
+   "Type": "AWS::Lambda::Permission",
+   "Properties": {
+    "Action": "lambda:InvokeFunction",
+    "FunctionName": {
+     "Fn::GetAtt": [
+      "MyLambdaCCE802FB",
+      "Arn"
+     ]
+    },
+    "Principal": "*",
+    "PrincipalOrgID": "o-xxxxxxxxxx2"
+   }
+  },
   "MyRoleF48FFE04": {
    "Type": "AWS::IAM::Role",
    "Properties": {
@@ -148,6 +162,52 @@
          "Arn"
         ]
        }
+      },
+      {
+       "Action": "lambda:InvokeFunction",
+       "Effect": "Allow",
+       "Resource": [
+        {
+         "Fn::GetAtt": [
+          "MyLambdaCCE802FB",
+          "Arn"
+         ]
+        },
+        {
+         "Fn::Join": [
+          "",
+          [
+           {
+            "Fn::GetAtt": [
+             "MyLambdaCCE802FB",
+             "Arn"
+            ]
+           },
+           ":",
+           {
+            "Fn::GetAtt": [
+             "v192FF9954",
+             "Version"
+            ]
+           }
+          ]
+         ]
+        },
+        {
+         "Fn::Join": [
+          "",
+          [
+           {
+            "Fn::GetAtt": [
+             "MyLambdaCCE802FB",
+             "Arn"
+            ]
+           },
+           ":$LATEST"
+          ]
+         ]
+        }
+       ]
       }
      ],
      "Version": "2012-10-17"
@@ -159,6 +219,14 @@
      }
     ]
    }
+  },
+  "v192FF9954": {
+   "Type": "AWS::Lambda::Version",
+   "Properties": {
+    "FunctionName": {
+     "Ref": "MyLambdaCCE802FB"
+    }
+   }
   }
  },
  "Parameters": {