[3.x] Fix Lambda permission SourceArn for default event bus

[GrahamCampbell]

This applies the same fix as #428 to the 3.x branch, where the bug is also present (refs #426). When an eventBridge event is configured with an explicit eventBus: default, the generated AWS::Lambda::Permission included a spurious default/ segment in its SourceArn condition, so the ArnLike condition never matched the real rule ARN (rule/<rule-name>) and EventBridge was silently denied invoking the function on every invocation. The SourceArn now omits the bus segment for the default bus, the default-bus tests assert the full SourceArn value, and coverage is added for a custom-named rule on the default bus.

The deprecated custom-resources path is not affected in the same silent way, since an explicit eventBus: default there already fails loudly at deploy time when the custom resource attempts to create the bus, so it is left untouched. Thanks to @james-at-tem for the diagnosis and the original patch, credited as co-author.