test(lambda): add direct coverage for grantInvokeLatestVersion resource grants

[pirothat]

Issue # (if applicable)

N/A

Reason for this change

Add a unit test for grantInvokeLatestVersion().

to invoke the latest version or the unqualified Lambda ARN, use grantInvokeLatestVersion(grantee)

Lambda README:
https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_lambda-readme.html

This behavior is part of the API contract and is worth pinning directly in a
unit test.

Description of changes

Verify that the synthesized IAM policy grants lambda:InvokeFunction with
Effect: Allow for both:

• the unqualified function ARN
• the $LATEST qualified ARN

Describe any new or updated permissions being added

N/A

Description of how you validated changes

Added a regression unit test for grantInvokeLatestVersion() in packages/aws-cdk-lib/aws-lambda/test/function.test.ts.

Checklist

• My code adheres to the CONTRIBUTING GUIDE and DESIGN GUIDELINES

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license