fix(custom-resources): fix circular dependency when a custom role provided to Provider (#33600)

### Issue # (if applicable)

Closes #20360

### Reason for this change

When users specify a isCompletehandler and specifies a custom role for the provider framework, the output template is not deployable due to circular dependencies.

### Description of changes

The change here is to deprecate the old `role` property because this `role` is shared between the 3 framework lambda functions. The state machine will depends on the sfn default policy. The default policy depends on isCompleteLambda (granting invoke function permission). isCompleteLambda depends on common default role policy. The common role  default policy has startExecution permission to SFN.

The solution is to deprecate `role` and introduce new roles for the onEvent lambda and isComplete/onTimeout lambda


### Describe any new or updated permissions being added

N/A

### Description of how you validated changes

New tests

### Checklist
- [ ] My code adheres to the [CONTRIBUTING GUIDE](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) and [DESIGN GUIDELINES](https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md)

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

Author: GavinZZ