fix(opensearchservice): OpenSearchAccessPolicy unnecessarily attempts to install latest sdk version (#28688)

This introduced uncertainty into the resource behavior, adds at least 60s to the execution time and will cause deployments in CN regions to fail.

No tests add because the existing tests run with the `@aws-cdk/customresources:installLatestAwsSdkDefault` feature flag set to the recommended value. This change is merely change the `OpenSearchAccessPolicy` config for users that don't set the feature flag. We can safely do this, because we control the code for this custom resource and know it works with the provided SDK version.

Related to #27597

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

Author: mrgrain

packages/aws-cdk-lib/aws-elasticsearch/lib/elasticsearch-access-policy.ts

@@ -33,6 +33,7 @@ export class ElasticsearchAccessPolicy extends cr.AwsCustomResource {
   constructor(scope: Construct, id: string, props: ElasticsearchAccessPolicyProps) {
     super(scope, id, {
       resourceType: 'Custom::ElasticsearchAccessPolicy',
+      installLatestAwsSdk: false,
       onUpdate: {
         action: 'updateElasticsearchDomainConfig',
         service: 'ES',

packages/aws-cdk-lib/aws-opensearchservice/lib/opensearch-access-policy.ts

@@ -33,6 +33,7 @@ export class OpenSearchAccessPolicy extends cr.AwsCustomResource {
   constructor(scope: Construct, id: string, props: OpenSearchAccessPolicyProps) {
     super(scope, id, {
       resourceType: 'Custom::OpenSearchAccessPolicy',
+      installLatestAwsSdk: false,
       onUpdate: {
         action: 'updateDomainConfig',
         service: 'OpenSearch',