…ws#15441)

Add an option under `addApplication` for a given stage to create a CodeBuild that checks if there are any security changes within the stage's assembly. 

* If the changes exist: **manual approval is required**
* else: a lambda function will automatically approve the manual approval action

Adding a security check to an application creates two actions that precede the prepare
and deploy actions of an application:
1. A CodeBuild Project that runs a security diff on the stage
2. A Manual Approval Action that can be approved via a shared Lambda function.

```txt
Pipeline
├── Stage: Build
│   └── ...
├── Stage: Synth
│   └── ...
├── Stage: UpdatePipeline
│   └── ...
├── Stage: MyApplicationStage
│   └── Actions
│       ├── MyApplicationSecurityCheck       // Security Diff Action
│       ├── MyApplicationManualApproval      // Manual Approval Action
│       ├── Stack.Prepare
│       └── Stack.Deploy
└── ...
```

<details>
<summary>Example Usage</summary>
You can enable the security check in one of two ways:

1. Enable security check across the entire `CdkStage`

    ```ts
    const pipeline = new CdkPipeline(app, 'Pipeline', {
      // ...source and build information here (see above)
    });
    const stage = pipeline.addApplicationStage(new MyApplication(this, 'Testing'), {
      securityCheck: true,
    });
    // The 'PreProd' application is also run against a security diff because we configured
    // the stage to enable security checks
    stage.addApplication(new MyApplication(this, 'PreProd'));
    ```

2. Enable security check for a single application

    ```ts
    const pipeline = new CdkPipeline(app, 'Pipeline', {
      // ...source and build information here (see above)
    });
    const stage = pipeline.addApplicationStage(new MyApplication(this, 'NoCheck'));
    stage.addApplication(new MyApplication(this, 'RunSecurityDiff'), {
      securityCheck: true,
    });
    ```

</details>

Fixes: aws#12748

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

…ws#15441)

Add an option under `addApplication` for a given stage to create a CodeBuild that checks if there are any security changes within the stage's assembly. 

* If the changes exist: **manual approval is required**
* else: a lambda function will automatically approve the manual approval action

Adding a security check to an application creates two actions that precede the prepare
and deploy actions of an application:
1. A CodeBuild Project that runs a security diff on the stage
2. A Manual Approval Action that can be approved via a shared Lambda function.

```txt
Pipeline
├── Stage: Build
│   └── ...
├── Stage: Synth
│   └── ...
├── Stage: UpdatePipeline
│   └── ...
├── Stage: MyApplicationStage
│   └── Actions
│       ├── MyApplicationSecurityCheck       // Security Diff Action
│       ├── MyApplicationManualApproval      // Manual Approval Action
│       ├── Stack.Prepare
│       └── Stack.Deploy
└── ...
```

<details>
<summary>Example Usage</summary>
You can enable the security check in one of two ways:

1. Enable security check across the entire `CdkStage`

    ```ts
    const pipeline = new CdkPipeline(app, 'Pipeline', {
      // ...source and build information here (see above)
    });
    const stage = pipeline.addApplicationStage(new MyApplication(this, 'Testing'), {
      securityCheck: true,
    });
    // The 'PreProd' application is also run against a security diff because we configured
    // the stage to enable security checks
    stage.addApplication(new MyApplication(this, 'PreProd'));
    ```

2. Enable security check for a single application

    ```ts
    const pipeline = new CdkPipeline(app, 'Pipeline', {
      // ...source and build information here (see above)
    });
    const stage = pipeline.addApplicationStage(new MyApplication(this, 'NoCheck'));
    stage.addApplication(new MyApplication(this, 'RunSecurityDiff'), {
      securityCheck: true,
    });
    ```

</details>

Fixes: aws#12748

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*