fix: authorize state machine alias events on the underlying ARN

[proton0210]

Issue #, if available

Closes #3720.

Description of changes

With UseAliasAsEventTarget: true, SAM grants states:StartExecution on the alias ARN, so EventBridge cannot start the state machine. Step Functions authorizes alias invocations against the underlying state machine ARN.

Pass the underlying state machine to event-role construction while keeping the alias as the invocation target. This fixes the shared permission path for EventBridgeRule, CloudWatchEvent, Schedule, ScheduleV2 and Api events.

Description of how you validated changes

• make pr on Python 3.12: all checks passed, 4,660 tests passed, 95.62% coverage.
• Five regression cases fail before the fix and pass afterward; all 254 focused tests pass.
• Compared 48 transforms before and after the fix across three partitions, covering alias/non-alias targets, custom schedule roles, permissions boundaries and conditional resources. Only the intended IAM policy resources change.

No live AWS deployment was run.

Checklist

• Review the generative AI contribution guidelines
• Adheres to the development guidelines
• Add/update transform tests
  • Using correct values
  • Using wrong values — no new input validation; existing missing-alias test passes.
• Add/update integration tests — validated through local transform tests; no deployed integration test added.

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.