fix(s3): resolve S3 notification removal race condition (#37708)

## Issue 
Closes #37667.

## Reason for this change

When removing a bucket notification from a multi-bucket stack, CloudFormation updates the handler's shared IAM policy to revoke the removed bucket's ARN before deleting the `Custom::S3BucketNotifications` resource. This causes the handler Lambda to fail with `AccessDenied` on `s3:PutBucketNotification` during cleanup.

The root cause is that `DependsOn` only controls create and delete ordering, not update ordering. When one of multiple buckets is removed, the shared `DefaultPolicy` is updated (not deleted), so the permission revocation happens before the custom resource cleanup runs.

## Description of changes

This fix replaces the shared `DefaultPolicy` with a dedicated `iam.Policy` per bucket notification. When a notification is removed, its dedicated policy is deleted rather than updated, which means CloudFormation correctly orders the custom resource deletion before the policy deletion via `DependsOn`.

**Files changed:**
- **notifications-resource.ts** - Core fix: creates a per-bucket `HandlerPolicy` via `attachInlinePolicy`
- **Unit tests** - Updated to expect the new `HandlerPolicy` in `DependsOn` arrays

## Describe any new or updated permissions being added

No new permissions added. The same S3 permissions are now granted via per-bucket inline policies instead of a shared `DefaultPolicy`.

## Description of how you validated changes

- All unit tests passing (473/473)
- All S3 notification-related tests passing
- Verified `DependsOn` behavior in test assertions

## Checklist
- [x] My code adheres to the [CONTRIBUTING GUIDE](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) and [DESIGN GUIDELINES](https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md)

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

Author: abidhasan-aws