feat: show early validation errors on deploy

[otaviomacedo]

CloudFormation has recently launched early validation. When creating the change set, CloudFormation validates a few things such as whether a resource with that physical ID already exists. More validations to come. But the specific information about the error (other than it's an early validation error) is not returned by the DescribeChangeSet API. The consumer is supposed to call a new API, DescribeEvents to get that information.

Introduce a new class,EarlyValidationReporter that checks whether such an error occurred and call the DescribeChangeSet API. The bootstrap stack was also updated to include permission to this new API. If the user's bootstrap stack is older than that, throw a special error to instruct the user to re-bootstrap.

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

[rix0rrr]

This might include events from multiple deployments, as long as they fit on one page.

We should only check events from the last deployment (perhaps even locate them based on an identifier, if that's feasible at all)

[otaviomacedo]

The toolkit deletes the old change set before creating a new one. And when a change set is deleted, all events are also deleted. So when a new one is created, and we are looking at its description here, it will contain only the events for this deployment.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 87.39%. Comparing base (2a6f8d3) to head (50ef569).

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #970   +/-   ##
=======================================
  Coverage   87.38%   87.39%           
=======================================
  Files          71       71           
  Lines       10010    10010           
  Branches     1311     1310    -1     
=======================================
+ Hits         8747     8748    +1     
+ Misses       1240     1239    -1     
  Partials       23       23           

Flag	Coverage Δ
suite.unit	87.39% <ø> (+<0.01%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[github-actions]

⚠️ Bootstrap Template Protection

This PR modifies the bootstrap template (packages/aws-cdk/lib/api/bootstrap/bootstrap-template.yaml), which requires special protections.

✅ All requirements met! This PR can proceed with normal review process.

Requirements

Version Increment
✅ Version incremented from 29 to 30

Security Review
✅ Review completed (PR has pr/security-reviewed label)

Why these protections exist

• The bootstrap template contains critical infrastructure
• Changes can affect IAM roles, policies, and resource access across all CDK deployments
• Version increments ensure users are notified of updates