Expose bucketArn/bucketName directly on SecureBucket

[alphacrack]

SecureBucket exposes the wrapped bucket as .bucket, so common attribute access reads as secureBucket.bucket.bucketArn / .bucket.bucketName. Standard L2-wrapping ergonomics (and IAM policy wiring, CfnOutput, etc.) expect these directly on the construct.

What to do

• Add pass-through readonly getters for at least bucketArn and bucketName (and consider bucketDomainName / bucketRegionalDomainName).
• jsii note: use plain public get bucketArn(): string getters — they translate cleanly to Python/Java/.NET properties.
• Add a small test asserting the getters resolve to the underlying bucket's tokens.

Acceptance criteria

• secureBucket.bucketArn and secureBucket.bucketName work without reaching through .bucket.