…36690)

### Issue # (if applicable)

Fixes false positive failures in Security Guardian for PR #36600

### Reason for this change

The `guardhooks-no-root-principals-except-kms-secrets.guard` rule was incorrectly failing on CloudFormation templates containing unresolved intrinsic functions (like `Fn::Join`, `Fn::Sub`) in IAM policy principals. This caused false positive security violations on legitimate CDK-generated templates.

**Error encountered:**
```
Error = [PathAwareValues are not comparable map, Regex]
Value = {"Fn::Join":["",["arn:",{"Ref":"AWS::Partition"},":iam::234567890123:role/..."]]}
ComparedWith = "/(?i):root$/"
```

### Description of changes

**Root Cause:** The rule had an inconsistency where:
- `AssumeRolePolicyDocument` section properly checked if array items were strings before validation
- `PolicyDocument`, `Policy`, and `ResourcePolicy` sections were **missing** this type check

This caused cfn-guard to attempt regex comparison on intrinsic function objects, resulting in comparison errors.

**Fix Applied:**
Changed the validation pattern from:
```guard
when Principal.AWS is_list {
    Principal.AWS[*] != /(?i):root$/  # Fails on objects
}
```

To:
```guard
when Principal.AWS is_list {
    Principal.AWS[*] {
        when this is_string {
            this != /(?i):root$/  # Only validates strings
        }
    }
}
```

This pattern:
1. Iterates through each array item individually
2. Only validates items that are strings
3. Skips intrinsic function objects (avoiding false positives on static templates)
4. Still catches real `:root` principals in resolved templates

**Files Changed:**
- `tools/@aws-cdk/security-guardian/rules/guard-hooks/guardhooks-no-root-principals-except-kms-secrets.guard`

**Alternatives Considered:**
- Adding `when Principal.AWS[*] is_string` guard: This checks if ALL items are strings, which fails when even one intrinsic function is present
- Disabling the rule for static templates: Would miss real violations in templates without intrinsics
- The chosen solution properly handles mixed arrays and maintains security validation

### Describe any new or updated permissions being added

No IAM permissions changes.

### Description of how you validated changes
Unit tests

### Checklist
- [x] My code adheres to the [CONTRIBUTING GUIDE](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) and [DESIGN GUIDELINES](https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md)

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*