fix(logs): use AccountPrincipal for drift prevention

[wasim-builds]

Issue

Closes #37797

What does this PR do?

Noticed a small bug causing false-positive CloudFormation drift alarms
because cross-account permissions were being written as raw account IDs
instead of ARNs. Swapped in AccountPrincipal to force the canonical ARN
format.

Testing

Tested locally and verified the output format matches the canonical ARN
format expected by CloudFormation.

---

By submitting this pull request, I confirm that my contribution is made
under the terms of the Apache-2.0 license.

[aws-cdk-automation]

(This review is outdated)

[wasim-builds]

Exemption Request

This is a minor, localized fix to swap ArnPrincipal for AccountPrincipal inside the log-group resource policy generation. This prevents CloudFormation drift by forcing the canonical ARN format. It only changes the string formatting in the synthesized CloudFormation template, which is fully covered by the unit test snapshots. Adding a new full integration test is unnecessary for this formatting change as it does not affect runtime application logic.

✅ Updated pull request passes all PRLinter validations. Dismissing previous PRLinter review.

[wasim-builds]

Hi! Following up on this — the AccountPrincipal fix for log-group drift prevention is small (+39/-7) and CI is passing. Would love a review when you have bandwidth!