feat: support existing Service Bus namespace with owned queue in event-handler

[despock]

Summary

Adds per-resource useExisting flags on the event-handler construct's serviceBus prop so a stack can reuse an externally-provisioned Service Bus namespace while still owning its queue and per-queue
authorization rule.

This enables consumers to consolidate many per-stack namespaces (one per function app) onto a smaller set of shared per-domain namespaces, while keeping queue lifecycle and access scoping with each stack.

Changes

construct/event-handler/types.ts

• New EventHandlerServiceBusNamespaceProps and EventHandlerServiceBusQueueProps, each extending the base props with an optional useExisting?: boolean.
• New optional queueAuthorizationRule?: QueueAuthorizationRule on EventHandlerServiceBus.
• Top-level serviceBus.useExisting retained as a deprecated alias (TODO marker added for removal once consumers migrate).

construct/event-handler/main.ts

• New resolveServiceBusUseExisting() helper consolidating the per-resource flag resolution. Per-resource flags take precedence over the deprecated top-level alias.
• Throws on the invalid combination namespace.useExisting=false + queue.useExisting=true (queue cannot be external if its parent isn't).
• Queue resource group correctly sources from namespace.resourceGroupName when the namespace is existing (previously always used the construct's RG, which broke external-namespace cases).
• createEventGridEventSubscription and createServiceBusDiagnosticLog now predicate on the resolved per-resource flag instead of the top-level alias.
• New createServiceBusQueueAuthorizationRule() creates a per-queue rule named ${this.id}-listen-send with [Listen, Send] rights when the construct owns the queue. Scopes Listen/Send permissions to a single
  queue rather than the namespace's root rule.
• createFunctionAppSiteConfig refactored to use a new resolveServiceBusConnectionString() helper that resolves to the per-queue rule's connection string when present, falling back to the existing behaviour
  otherwise.

services/servicebus/{main,types}.ts

• New createServiceBusQueueAuthorizationRule() method and ServiceBusQueueAuthorizationRuleProps type on AzureServiceBusManager.

services/authorisation/constants.ts

• New AZURE_SERVICE_BUS_DATA_OWNER role definition id (/providers/Microsoft.Authorization/roleDefinitions/090c5cfd-751d-490a-894a-3ce6f1109419) for stacks that grant the regional SPN owner rights on shared
  namespaces.

Backwards compatibility

• Stacks that set serviceBus.useExisting=true|false continue to work unchanged - the alias resolves to both per-resource flags.
• Stacks that previously had no serviceBus.namespace/serviceBus.queue config still default to the historical "create both" behaviour.
• No public API removed; the deprecated alias will be removed in a follow-up after downstream consumers migrate.