fix(core): correctly reference versionless secure parameters (#18730)

When no version is specified, the `:` at the end is not allowed.

Closes #18729.


----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

Author: dbartholomae

Diff for: packages/@aws-cdk/core/lib/secret-value.ts

@@ -71,8 +71,9 @@ export class SecretValue extends Intrinsic {
    * latest version of the parameter.
    */
   public static ssmSecure(parameterName: string, version?: string): SecretValue {
-    const parts = [parameterName, version ?? ''];
-    return this.cfnDynamicReference(new CfnDynamicReference(CfnDynamicReferenceService.SSM_SECURE, parts.join(':')));
+    return this.cfnDynamicReference(
+      new CfnDynamicReference(CfnDynamicReferenceService.SSM_SECURE,
+        version ? `${parameterName}:${version}` : parameterName));
   }
 
   /**

Diff for: packages/@aws-cdk/core/test/secret-value.test.ts

@@ -127,7 +127,7 @@ describe('secret value', () => {
     const v = SecretValue.ssmSecure('param-name');
 
     // THEN
-    expect(stack.resolve(v)).toEqual('{{resolve:ssm-secure:param-name:}}');
+    expect(stack.resolve(v)).toEqual('{{resolve:ssm-secure:param-name}}');
   });
 
   test('cfnDynamicReference', () => {