feat(rds): eliminating the need for explicit secret.grantRead() inv…

…okes when using DataAPI with Aurora cluster (#29399)

### Issue # (if applicable)

Closes #29362.

### Reason for this change

As discussed [there](#29338 (comment)), we should invoke `secret.grantRead()` explicitly when using DataAPI with Aurora cluster.
Because it's inconvenient for users, I made  `secret.grantRead()` be invoked within `cluster.grantDataApiAccess()`.

### Description of changes

- move `cluster.secret` from `DatabaseClusterNew` to `DatabaseClusterBase` to use it within `DatabaseClusterBase.grantDataApiAccess()`
- add `secret.grantRead()` in `cluster.grantDataApiAccess()`
- add `secret` property to `DatabaseClusterAttributes`

#### Points of concern

`DatabaseClusterBase` class is extended by `ImportedDatabaseCluster` class. Therefore, it is necessary to define `ImportedDatabaseCluster.secret`.

I simply added `secret` props to `DatabaseClusterAttributes` but I cannot believe this is the best way.
Other ways are..
- add `secretArn` to `DatabaseClusterAttributes`
- don't add secret info and `ImportedDatabaseCluster.secret` becomes always undefined

### Description of how you validated changes



### Checklist
- [x] My code adheres to the [CONTRIBUTING GUIDE](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) and [DESIGN GUIDELINES](https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md)

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

packages/@aws-cdk-testing/framework-integ/test/aws-rds/test/integ.cluster-data-api.js.snapshot/cluster-kerberos.template.json → packages/@aws-cdk-testing/framework-integ/test/aws-rds/test/integ.cluster-data-api.js.snapshot/cluster-data-api.template.json

@@ -10,7 +10,7 @@
     "Tags": [
      {
       "Key": "Name",
-      "Value": "cluster-kerberos/VPC"
+      "Value": "cluster-data-api/VPC"
      }
     ]
    }
@@ -39,7 +39,7 @@
      },
      {
       "Key": "Name",
-      "Value": "cluster-kerberos/VPC/PublicSubnet1"
+      "Value": "cluster-data-api/VPC/PublicSubnet1"
      }
     ],
     "VpcId": {
@@ -53,7 +53,7 @@
     "Tags": [
      {
       "Key": "Name",
-      "Value": "cluster-kerberos/VPC/PublicSubnet1"
+      "Value": "cluster-data-api/VPC/PublicSubnet1"
      }
     ],
     "VpcId": {
@@ -94,7 +94,7 @@
     "Tags": [
      {
       "Key": "Name",
-      "Value": "cluster-kerberos/VPC/PublicSubnet1"
+      "Value": "cluster-data-api/VPC/PublicSubnet1"
      }
     ]
    }
@@ -114,7 +114,7 @@
     "Tags": [
      {
       "Key": "Name",
-      "Value": "cluster-kerberos/VPC/PublicSubnet1"
+      "Value": "cluster-data-api/VPC/PublicSubnet1"
      }
     ]
    },
@@ -147,7 +147,7 @@
      },
      {
       "Key": "Name",
-      "Value": "cluster-kerberos/VPC/PublicSubnet2"
+      "Value": "cluster-data-api/VPC/PublicSubnet2"
      }
     ],
     "VpcId": {
@@ -161,7 +161,7 @@
     "Tags": [
      {
       "Key": "Name",
-      "Value": "cluster-kerberos/VPC/PublicSubnet2"
+      "Value": "cluster-data-api/VPC/PublicSubnet2"
      }
     ],
     "VpcId": {
@@ -202,7 +202,7 @@
     "Tags": [
      {
       "Key": "Name",
-      "Value": "cluster-kerberos/VPC/PublicSubnet2"
+      "Value": "cluster-data-api/VPC/PublicSubnet2"
      }
     ]
    }
@@ -222,7 +222,7 @@
     "Tags": [
      {
       "Key": "Name",
-      "Value": "cluster-kerberos/VPC/PublicSubnet2"
+      "Value": "cluster-data-api/VPC/PublicSubnet2"
      }
     ]
    },
@@ -255,7 +255,7 @@
      },
      {
       "Key": "Name",
-      "Value": "cluster-kerberos/VPC/PrivateSubnet1"
+      "Value": "cluster-data-api/VPC/PrivateSubnet1"
      }
     ],
     "VpcId": {
@@ -269,7 +269,7 @@
     "Tags": [
      {
       "Key": "Name",
-      "Value": "cluster-kerberos/VPC/PrivateSubnet1"
+      "Value": "cluster-data-api/VPC/PrivateSubnet1"
      }
     ],
     "VpcId": {
@@ -324,7 +324,7 @@
      },
      {
       "Key": "Name",
-      "Value": "cluster-kerberos/VPC/PrivateSubnet2"
+      "Value": "cluster-data-api/VPC/PrivateSubnet2"
      }
     ],
     "VpcId": {
@@ -338,7 +338,7 @@
     "Tags": [
      {
       "Key": "Name",
-      "Value": "cluster-kerberos/VPC/PrivateSubnet2"
+      "Value": "cluster-data-api/VPC/PrivateSubnet2"
      }
     ],
     "VpcId": {
@@ -375,7 +375,7 @@
     "Tags": [
      {
       "Key": "Name",
-      "Value": "cluster-kerberos/VPC"
+      "Value": "cluster-data-api/VPC"
      }
     ]
    }
@@ -543,6 +543,16 @@
    "Properties": {
     "PolicyDocument": {
      "Statement": [
+      {
+       "Action": [
+        "secretsmanager:DescribeSecret",
+        "secretsmanager:GetSecretValue"
+       ],
+       "Effect": "Allow",
+       "Resource": {
+        "Ref": "DatabaseSecretAttachmentE5D1B020"
+       }
+      },
       {
        "Action": [
         "rds-data:BatchExecuteStatement",
@@ -575,16 +585,6 @@
          ]
         ]
        }
-      },
-      {
-       "Action": [
-        "secretsmanager:DescribeSecret",
-        "secretsmanager:GetSecretValue"
-       ],
-       "Effect": "Allow",
-       "Resource": {
-        "Ref": "DatabaseSecretAttachmentE5D1B020"
-       }
       }
      ],
      "Version": "2012-10-17"