feat(lambda): add PropagateTags to CapacityProvider for tag propagation

[vicheey]

Issue # (if applicable)

Closes #38181

N/A

Reason for this change

Lambda CapacityProvider now supports PropagateTags in CloudFormation, allowing customers to propagate tags to managed EC2 instances, ENIs, and EBS volumes. This enables tag-based security policies and cost allocation on managed infrastructure. The L1 property exists but there's no L2 support yet.

Description of changes

Adds a propagateTags prop to CapacityProviderProps using the static factory class pattern (matching ScalingOptions and InstanceTypeFilter already on this construct):

new lambda.CapacityProvider(this, 'CP', {
  subnets: vpc.privateSubnets,
  securityGroups: [securityGroup],
  propagateTags: lambda.PropagateTags.explicit([
    { key: 'CostCenter', value: 'Engineering' },
  ]),
});

Available factories:

• PropagateTags.none() — explicitly disable propagation (emits Mode: None)
• PropagateTags.explicit(tags) — propagate specified tags (emits Mode: Explicit + ExplicitTags)

When omitted, nothing is emitted to CloudFormation (API default applies).

The PropagateTags class uses a private constructor so users cannot construct invalid configurations. The class is structurally compatible with the L1 PropagateTagsConfigProperty, enabling direct passthrough without manual object mapping.

Validation: max 40 explicit tags (enforced at synth time).

Describe any new or updated permissions being added

None.

Description of how you validated changes

• Unit tests: 4 new test cases (explicit mode, none mode, omitted prop, max tags validation)
• Integration test: deployed to personal account, snapshot committed
• Build: jsii + eslint + awslint all pass
• All 37 capacity-provider unit tests pass

Checklist

• My code adheres to the CONTRIBUTING GUIDE and DESIGN GUIDELINES

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license