Most `MachineImage` implementations look up AMIs from SSM Parameters,
and by default they will all look up the Parameters on each deployment.

This leads to instance replacement. Since we already know the SSM
Parameter Name and CDK already has a cached SSM context lookup, it
should be simple to get a stable AMI ID. This is not ideal because the
AMI will grow outdated over time, but users should have the option to
pick non-updating images in a convenient way.

Fixes #12484.

…ng-ami