fix(cloudfront): serve DefaultRootObject at the distribution root

[Sorttech]

DefaultRootObject was parsed onto the model and never read, so a viewer
request for the distribution root reached the origin as /. Against an S3
origin that returns the bucket's ListBucketResult XML instead of the SPA
shell.

Resolve it alongside the cache behavior and fetch it in place of the root
path, preserving the query string. AWS applies the default root object to
the distribution root ONLY, so a subdirectory request is never rewritten to
<dir>/<object>; a blank config value is ignored and a stray leading slash
is normalized rather than proxied as //index.html.

Test plan

Regression test: serves_default_root_object_at_the_distribution_root in crates/fakecloud-e2e/tests/cloudfront_dataplane.rs

Verification

On this exact head, rebased onto current main:

• cargo fmt --all --check - clean.
• cargo clippy --workspace --all-targets -- -D warnings - clean.
• cargo test --workspace excluding fakecloud-e2e, fakecloud-conformance,
  fakecloud-tfacc and fakecloud-parity (the same set CI's test job runs),
  plus cargo test -p fakecloud-conformance --lib - 9838 passed, 0 failed
  (--no-fail-fast, --test-threads=4). An earlier run of the same command
  failed once in fakecloud-ssm
  (service::tests::rearm_in_flight_commands_settles_restored_pending) and
  passed on rerun. That test reads the last durable snapshot right after the
  in-memory status flips to Success while the save is asynchronous; it fails
  4 of 11 runs on untouched main on this machine. This branch does not touch
  SSM.
• cargo test -p fakecloud-e2e --test cloudfront_dataplane - the regression
  test above passes against a freshly built target/debug/fakecloud.

Found by deploying a CDK CloudFront + S3 SPA against fakecloud.

[Sorttech]

Retargeted upstream as faiscadev#2560.