fix(logs): use account root ARN principals

[MukundaKatta]

Issue

Closes #37797.

Reason for this change

LogGroup.addToResourcePolicy() converted IAM ARN principals to bare AWS account IDs before synthesizing the CloudWatch Logs resource policy. CloudFormation accepts that form, but stores the principal canonically as arn:${AWS::Partition}:iam::<account>:root, which causes drift detection to report a persistent false positive.

Description of changes

This changes the conversion to use iam.AccountPrincipal, so ARN principals are reduced to canonical account root ARN principals instead of bare account IDs. The existing log group tests now assert the synthesized policy document uses the account root ARN form, including the tokenized imported-role-ARN case.

Description of how you validated changes

• yarn --cwd packages/aws-cdk-lib test aws-logs/test/loggroup.test.ts --runInBand --coverage=false
• yarn --cwd packages/aws-cdk-lib test aws-logs/test/policy.test.ts --runInBand --coverage=false

[aws-cdk-automation]

The pull request linter fails with the following errors:

❌ Fixes must contain a change to an integration test file and the resulting snapshot.

If you believe this pull request should receive an exemption, please comment and provide a justification. A comment requesting an exemption should contain the text Exemption Request. Additionally, if clarification is needed, add Clarification Request to a comment.

✅ A exemption request has been requested. Please wait for a maintainer's review.

[aws-cdk-automation]

This PR has been in the CHANGES REQUESTED state for 3 weeks, and looks abandoned. Note that PRs with failing linting check or builds are not reviewed, please ensure your build is passing

To prevent automatic closure:

• Resume work on the PR
• OR request an exemption by adding a comment containing 'Exemption Request' with justification e.x "Exemption Request: "
• OR request clarification by adding a comment containing 'Clarification Request' with a question e.x "Clarification Request: "

This PR will automatically close in 14 days if no action is taken.

[MukundaKatta]

Exemption Request: This is a small, self-contained fix (use account-root ARN principals for the log-group resource policy). I'd like to keep it open while I get CI green — I'll rebase on main and address the failing build. Could you point me at the specific blocking check? Happy to adjust.