feat(certificatemanager): throw ValidationErrors instead of untyped Errors (aws#33440)

### Issue 

Relates to aws#32569 

### Description of changes

`ValidationErrors` everywhere

### Describe any new or updated permissions being added

n/a

### Description of how you validated changes

Existing tests. Exemptions granted as this is a refactor of existing code.

### Checklist
- [x] My code adheres to the [CONTRIBUTING GUIDE](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) and [DESIGN GUIDELINES](https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md)

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

Author: kaizencc

packages/aws-cdk-lib/.eslintrc.js

@@ -33,6 +33,7 @@ const enableNoThrowDefaultErrorIn = [
   'aws-backup',
   'aws-batch',
   'aws-chatbot',
+  'aws-certificatemanager',
   'aws-cognito',
   'aws-cloudfront',
   'aws-cloudfront-origins',

packages/aws-cdk-lib/aws-certificatemanager/lib/certificate.ts

@@ -4,7 +4,7 @@ import { CfnCertificate } from './certificatemanager.generated';
 import { apexDomain } from './util';
 import * as cloudwatch from '../../aws-cloudwatch';
 import * as route53 from '../../aws-route53';
-import { IResource, Token, Tags } from '../../core';
+import { IResource, Token, Tags, ValidationError } from '../../core';
 import { addConstructMetadata } from '../../core/lib/metadata-resource';
 
 /**
@@ -287,7 +287,7 @@ export class Certificate extends CertificateBase implements ICertificate {
 
     // check if domain name is 64 characters or less
     if (!Token.isUnresolved(props.domainName) && props.domainName.length > 64) {
-      throw new Error('Domain name must be 64 characters or less');
+      throw new ValidationError('Domain name must be 64 characters or less', this);
     }
 
     const allDomainNames = [props.domainName].concat(props.subjectAlternativeNames || []);
@@ -300,7 +300,7 @@ export class Certificate extends CertificateBase implements ICertificate {
     const cert = new CfnCertificate(this, 'Resource', {
       domainName: props.domainName,
       subjectAlternativeNames: props.subjectAlternativeNames,
-      domainValidationOptions: renderDomainValidation(validation, allDomainNames),
+      domainValidationOptions: renderDomainValidation(this, validation, allDomainNames),
       validationMethod: validation.method,
       certificateTransparencyLoggingPreference,
       keyAlgorithm: props.keyAlgorithm?.name,
@@ -332,7 +332,7 @@ export enum ValidationMethod {
 }
 
 // eslint-disable-next-line max-len
-function renderDomainValidation(validation: CertificateValidation, domainNames: string[]): CfnCertificate.DomainValidationOptionProperty[] | undefined {
+function renderDomainValidation(scope: Construct, validation: CertificateValidation, domainNames: string[]): CfnCertificate.DomainValidationOptionProperty[] | undefined {
   const domainValidation: CfnCertificate.DomainValidationOptionProperty[] = [];
 
   switch (validation.method) {
@@ -348,13 +348,13 @@ function renderDomainValidation(validation: CertificateValidation, domainNames:
       for (const domainName of domainNames) {
         const validationDomain = validation.props.validationDomains?.[domainName];
         if (!validationDomain && Token.isUnresolved(domainName)) {
-          throw new Error('When using Tokens for domain names, \'validationDomains\' needs to be supplied');
+          throw new ValidationError('When using Tokens for domain names, \'validationDomains\' needs to be supplied', scope);
         }
         domainValidation.push({ domainName, validationDomain: validationDomain ?? apexDomain(domainName) });
       }
       break;
     default:
-      throw new Error(`Unknown validation method ${validation.method}`);
+      throw new ValidationError(`Unknown validation method ${validation.method}`, scope);
   }
 
   return domainValidation.length !== 0 ? domainValidation : undefined;

packages/aws-cdk-lib/aws-certificatemanager/lib/dns-validated-certificate.ts

@@ -98,7 +98,7 @@ export class DnsValidatedCertificate extends CertificateBase implements ICertifi
     this.domainName = props.domainName;
     // check if domain name is 64 characters or less
     if (!Token.isUnresolved(props.domainName) && props.domainName.length > 64) {
-      throw new Error('Domain name must be 64 characters or less');
+      throw new cdk.ValidationError('Domain name must be 64 characters or less', this);
     }
     this.normalizedZoneName = props.hostedZone.zoneName;
     // Remove trailing `.` from zone name