fix(logs): emit canonical root ARN for ResourcePolicy principals

[wasim-builds]

Fixes #37797

Problem

convertArnPrincipalToAccountId emits a bare account ID instead of the canonical root ARN (arn:aws:iam::<account>:root). CloudFormation stores the canonical form, so the mismatch causes permanent false drift on AWS::Logs::ResourcePolicy.

Fix

Emit the canonical root ARN from convertArnPrincipalToAccountId.

Scope

• packages/aws-cdk-lib/aws-logs/lib/log-group.ts: emit canonical ARN
• packages/aws-cdk-lib/aws-logs/test/loggroup.test.ts: update expectations
• Integration test added

Verification

CloudFormation drift detection no longer reports false positives for log resource policies.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[aws-cdk-automation]

(This review is outdated)

[wasim-builds]

Exemption Request: The fix handles canonical root ARNs and an integration test may be difficult to assert on or is covered by unit tests.

✅ Updated pull request passes all PRLinter validations. Dismissing previous PRLinter review.

[wasim-builds]

The unresolved account errors and snapshot issues have been fixed and pushed.

[github-actions]

Comments on closed issues and PRs are hard for our team to see.
If you need help, please open a new issue that references this one.