feat: align the python starter kit with the typescript one

Brings the Python kit up to the feature set and structure of
aws-cdk-starter-kit, which has been the one getting the new features.

Structure:
- src/aspects: permission boundary, S3 encryption, S3 public access and
  RFC 1918 VPC CIDR aspects, with a README.
- src/stacks: FoundationStack (deploy role + CDK toolkit cleaner) and
  StarterStack replace GitHubOIDCStack and BaseStack.
- src/custom_constructs: the OIDC role moves out of the stack into
  GitHubActionsOidcConstruct. The folder keeps its name because a
  src/constructs package would shadow the constructs pip package.

Deployments:
- EnvironmentConfig replaces the target_accounts dict. Environments are
  test (branch deploys on) and production, deployed in list order.
- Branch deployments: GIT_BRANCH_REF names stacks after the branch,
  express mode on ephemeral test stacks, and a destroy workflow on
  branch deletion. FoundationStack is skipped for branch deploys.
- Tasks gain :all/:stack variants plus ls and branch-only hotswap.

CI:
- build.yml runs ruff, ty, pytest and synth on every PR, with projen's
  self-mutation push. Nothing ran tests in CI before.
- cdk-diff-pr-comment posts a diff on pull requests.
- release.yml tags and publishes when the project version changes.
- The CDK CLI comes from the pinned aws-cdk-cli PyPI package instead of
  npm install -g aws-cdk, so the cdk_cli_version pin is real.

Two places where a literal port would have broken:
- BucketPublicAccessAspect catches the ValueError jsii raises when
  reading a struct set from the TypeScript side, which every bucket
  built through the Bucket L2 construct hits.
- The destroy workflow filters branches in the job condition, because
  GitHub ignores a branches filter on delete events.

BREAKING CHANGE: the deploy role is now named GitHubActionsServiceRole
rather than GitHubDeployRole, and the dev:* tasks and cdk-deploy-dev
workflow are replaced by test:* and production:*.

Author: dannysteenman