feat(secretsmanager): add BatchGetSecretValue permission to Secret.grantRead()

[pahud]

WIP

Issue # (if applicable)

Closes #31566.

Reason for this change

The Secret.grantRead() method was missing the secretsmanager:BatchGetSecretValue permission, preventing developers from using the AWS SDK's BatchGetSecretValueCommand without manually configuring additional IAM permissions. This created an inconsistent developer experience where batch operations required extra IAM setup beyond the standard CDK grant methods.

Description of changes

Enhanced the Secret.grantRead() method to include secretsmanager:BatchGetSecretValue permission alongside the existing GetSecretValue and DescribeSecret permissions. This change:

• Adds 'secretsmanager:BatchGetSecretValue' to the actions array in the grantRead() method
• Updates all related unit tests to expect the new permission in generated IAM policies
• Maintains full backward compatibility - existing code continues to work unchanged
• Follows the established pattern used by other AWS services (like DynamoDB) that include batch operations by default
• Preserves all existing functionality including version stage constraints, KMS integration, and cross-account validation

Describe any new or updated permissions being added

IAM permissions: Added secretsmanager:BatchGetSecretValue permission to IAM policies generated by Secret.grantRead() method.

Resource access: The new permission uses the same resource scoping as existing permissions (secret ARN with proper wildcards for version stages). No additional resource access patterns are introduced.

Description of how you validated changes

• Unit tests: Updated existing grantRead test cases to verify secretsmanager:BatchGetSecretValue is included in generated IAM policies. All tests pass with the enhanced permission set.
• Integration tests: Existing integration tests continue to pass, confirming CloudFormation deployment succeeds with the enhanced IAM policies and all functionality remains intact.

Checklist

• My code adheres to the CONTRIBUTING GUIDE and DESIGN GUIDELINES

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

[aws-cdk-automation]

The pull request linter fails with the following errors:

❌ Features must contain a change to a README file.
❌ Features must contain a change to an integration test file and the resulting snapshot.

If you believe this pull request should receive an exemption, please comment and provide a justification. A comment requesting an exemption should contain the text Exemption Request. Additionally, if clarification is needed, add Clarification Request to a comment.