feat(apigateway): alb integration

[badmintoncryer]

Issue # (if applicable)

None

Reason for this change

REST API now supports private integration with ALB using VPC Link V2, without requiring a Network Load Balancer as an intermediary.

https://docs.aws.amazon.com/apigateway/latest/developerguide/set-up-private-integration.html

Description of changes

Added a new AlbIntegration class that enables direct integration between API Gateway REST API and Application Load Balancers using VPC Link V2.

• Automatic VPC Link V2 creation if not provided
• VPC Link reuse for multiple ALBs in the same VPC
• Support for both proxy (HTTP_PROXY) and custom (HTTP) integration types
• Support for imported ALBs with VPC information

Security Group Handling

The security group configuration follows the same pattern as the existing HTTP API (APIGatewayV2) ALB integration (HttpAlbIntegration):

• By default, VpcLink is created with empty SecurityGroupIds (no security groups attached)
• Users can optionally provide a custom VpcLink with explicit security groups for stricter security controls

This design ensures consistency between REST API and HTTP API when integrating with ALBs.

Describe any new or updated permissions being added

No new IAM permissions are added.

Description of how you validated changes

Add both unit and integ tests.

Checklist

• My code adheres to the CONTRIBUTING GUIDE and DESIGN GUIDELINES

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

[badmintoncryer]

• Review unit test
• investigate vpc link security group setting

[github-actions]

	Tests	Passed ☑️	Skipped	Failed ❌️
Security Guardian Results	52 ran	49 passed	0 skipped	3 failed

Test	Result
Security Guardian Results
packages/@aws-cdk-testing/framework-integ/test/aws-apigateway/test/integ.alb-integration.js.snapshot/AlbIntegrationIntegDefaultTestDeployAssert7B33A2E6.template.json
iam-no-wildcard-actions-inline.guard	❌ failure
packages/@aws-cdk-testing/framework-integ/test/aws-apigateway/test/integ.alb-integration.js.snapshot/AlbIntegrationTestStack.template.json
ec2-no-open-security-groups.guard	❌ failure
iam-no-wildcard-actions-inline.guard	❌ failure

• View Security Guardian Results

[github-actions]

	Tests	Passed ☑️	Skipped	Failed ❌️
Security Guardian Results with resolved templates	52 ran	49 passed	0 skipped	3 failed

Test	Result
Security Guardian Results with resolved templates
packages/@aws-cdk-testing/framework-integ/test/aws-apigateway/test/integ.alb-integration.js.snapshot/AlbIntegrationIntegDefaultTestDeployAssert7B33A2E6.template.json
iam-no-wildcard-actions-inline.guard	❌ failure
packages/@aws-cdk-testing/framework-integ/test/aws-apigateway/test/integ.alb-integration.js.snapshot/AlbIntegrationTestStack.template.json
ec2-no-open-security-groups.guard	❌ failure
iam-no-wildcard-actions-inline.guard	❌ failure

• View Security Guardian Results with resolved templates