Add CloudFront AccessLevel.READ_VERSIONED

This allows creating an S3 bucket origin OriginAccessControl for access of versioned objects

Fixes aws#33034

packages/@aws-cdk-testing/framework-integ/test/aws-cloudfront-origins/test/integ.s3-origin-oac-read-versioned.ts

@@ -0,0 +1,24 @@
+import * as cloudfront from 'aws-cdk-lib/aws-cloudfront';
+import * as s3 from 'aws-cdk-lib/aws-s3';
+import * as cdk from 'aws-cdk-lib';
+import * as origins from 'aws-cdk-lib/aws-cloudfront-origins';
+import { ExpectedResult, IntegTest } from '@aws-cdk/integ-tests-alpha';
+
+const app = new cdk.App();
+
+const stack = new cdk.Stack(app, 'cloudfront-s3-bucket-origin-oac-read-versioned-access');
+
+const bucket = new s3.Bucket(stack, 'Bucket', {
+  removalPolicy: cdk.RemovalPolicy.DESTROY,
+});
+origins.S3BucketOrigin.withOriginAccessControl(bucket, {
+  originAccessLevels: [cloudfront.AccessLevel.READ, cloudfront.AccessLevel.READ_VERSIONED],
+});
+
+const integ = new IntegTest(app, 's3-origin-oac-read-versioned-access', {
+  testCases: [stack],
+});
+
+integ.assertions.awsApiCall('S3', 'getBucketPolicy', {
+  Bucket: bucket.bucketName,
+}).expect(ExpectedResult.objectLike({ Statement: [{ Action: ['s3:GetObject', 's3:GetObjectVersion'] }] }));