chore(elbv2): add RFC 9151 (CNSA 1.0) SSL security policies for ALB and NLB

[rgoltz]

Issue # (if applicable)

Relates to #38666.

Reason for this change

AWS added TLS-based security policies for Application Load Balancer (HTTPS listeners) and Network Load Balancer (TLS listeners) that comply with RFC 9151 for the Commercial National Security Algorithm (CNSA) 1.0 suite: AWS Application and Network Load Balancers now support RFC 9151 compliant security policies from August 2026.

The CDK SslPolicy enum did not expose these policies yet, so users had to workaround via mixin or fall back to the L1 escape hatch to select them. Let's change this.

Description of changes

Added the 7 RFC 9151 (CNSA 1.0) security policies to the shared SslPolicy enum (used by both ALB and NLB listeners):

• Strict policies (enforce full RFC 9151 requirements):
  • RFC9151_TLS13_13 → ELBSecurityPolicy-TLS13-1-3-RFC9151-FIPS-2023-07
  • RFC9151_TLS13_12 → ELBSecurityPolicy-TLS13-1-2-RFC9151-FIPS-2023-07
  • RFC9151_TLS13_12_EXT0 → ELBSecurityPolicy-TLS13-1-2-Ext0-RFC9151-FIPS-2023-07
• Interop policies (mix RFC 9151 and non-RFC 9151 ciphers for gradual transition):
  • RFC9151_TLS13_12_INTEROP1 → ELBSecurityPolicy-TLS13-1-2-RFC9151-INTEROP1-FIPS-2023-07
  • RFC9151_TLS13_12_INTEROP2 → ELBSecurityPolicy-TLS13-1-2-RFC9151-INTEROP2-FIPS-2023-07
  • RFC9151_TLS13_12_INTEROP3 → ELBSecurityPolicy-TLS13-1-2-RFC9151-INTEROP3-FIPS-2023-07
  • RFC9151_TLS13_12_INTEROP4 → ELBSecurityPolicy-TLS13-1-2-RFC9151-INTEROP4-FIPS-2023-07

No behavior or default changes: the CloudFormation default (ELBSecurityPolicy-2016-08) is unchanged, and no feature flag is introduced. SslPolicy is a free-form string in the CloudFormation AWS::ElasticLoadBalancingV2::Listener spec (no AllowedValues constraint), so the value is passed through to the ELBv2 API at deploy time. Each enum member documents the supported TLS versions and ciphers and links to the AWS documentation.

Describe any new or updated permissions being added

None.

Description of how you validated changes

• Updated unit tests for both ALB HTTPS and NLB TLS listeners asserting that each new policy resolves to the correct SslPolicy value. All of them passed.
• Verified the policy names against the live ELBv2 API using aws elbv2 describe-ssl-policies. The API returns exactly these 7 RFC9151 policy names. This is the same API CloudFormation forwards SslPolicy to at deploy time.
• Cross-checked the names against the AWS ELB describe-ssl-policies documentation for ALB and NLB

Checklist

• My code adheres to the CONTRIBUTING GUIDE and DESIGN GUIDELINES

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license