Fixes #1891

Testing: all toolkit integration tests passed.

BREAKING CHANGE:

* **cli:** This release requires CDK CLI >= 0.34.0
* **core:** `App.run()` was renamed to `App.synth()` (soft deprecation, it will be removed in the next release).
* **core:** The `Stack.autoDeploy` feature has been removed. You can use `cdk deploy STACK ...` to determine which stacks to deploy (and wildcards are supported, so `cdk deploy '*'` will deploy all stacks. We plan to change the CLI to require specifying stacks if there is more than a single stack in the app (#2750).
* **core:** `ConstructNode.aspects` is now private.
* **core:** The `Synthesizer` has been removed. Use `ConstructNode.synth(node)` instead.
* **core:** `ISynthesizable.synthesize` now accepts an `ISynthesisSession` which contains the `CloudAssemblyBuilder` object. This will allow further extension in the future.
* **cx-api:** `cxapi.MissingContext` now includes the context `key`
* **core:** `Stack.reportMissingContext` now accepts a single argument of type `cxapi.MissingContext`, which includes the missing context key
* **core:** `Stack.annotatePhysicalName` has been removed (not used).
* **core:** `Stack.missingContext` is now private.
* **cx-api:** Multiple changes to the cloud assembly APIs to reduce surface area and clean up.
* **cdk-integ (private):** if an integration test includes multiple stacks, use `/// !cdk-integ STACK ...`  to explicitly specify which stacks to include in the test.

And when set, demand that a NodeJS-style stability badge is present in the README.md

GitHub markdown does not allow use of inline CSS on `<div>` elements,
resulting in a poor looking `README.md` experience on the website.
Adjusted the style to use a blockquote in order to have the stability
indication stand out more, while being visually pleasant.

BREAKING CHANGE: The `EncryptionKeyAlias` class was renamed to `Alias`.
Associated types (such as `EncryptionKeyAliasProps`) were renamed in the
same way.

Closes #1934

BREAKING CHANGE:
* **core:** `node.stack` is now `Stack.of(construct)` (fixes #2766)
* **core:** `node.resolve` has been moved to `stack.resolve`.
* **core:** `node.stringifyJson` has been moved to `stack.stringifyJson`.
* **core:** `node.validateTree` is now `ConstructNode.validate(node)`
* **core:** `node.prepareTree` is now `ConstructNode.prepare(node)`
* **core:** `node.getContext` is now `node.tryGetContext`
* **core:** `node.recordReference` is now `node.addReference`
* **core:** `node.apply` is now `node.applyAspect`
* **core:** `node.ancestors()` is now `node.scopes`
* **core:** `node.required` has been removed.
* **core:** `node.typename` has been removed.
* **core:** `node.addChild` is now private
* **core:** `node.findReferences()` is now `node.references`
* **core:** `node.findDependencies()` is now `node.dependencies`
* **core:** `stack.dependencies()` is now `stack.dependencies`
* **core:** `CfnElement.stackPath` has been removed.
* **core:** `CloudFormationLang` is now internal (use `stack.toJsonString()`)

#2779)

Constructs for records (CNAME, TXT, etc.) now extend the `RecordSet` construct and
offer better typed properties interfaces.

Add constructs for A, AAAA, CAA, MX and SRV records.

Add support for multiple values in basic records.

Make `recordName` optional with default to zone root.

Add a "security" `CaaAmazonRecord` construct to easily restrict certificate authorities
allowed to issue certificates for a domain to Amazon only.

BREAKING CHANGE: `recordValue: string` prop in `route53.TxtRecord` changed to `values: string[]`
* `recordValue` prop in `route53.CnameRecord` renamed to `domainName`
* `route53.AliasRecord` has been removed, use `route53.ARecord` or `route53.AaaaRecord` with the `target` prop.

Work around aws/jsii#525.

There are a couple of places where fields accept values that are typed
as `Json` per the JSII type specification. This conveys that literal
`null` values may be passed and need to be preserved (as far as JSII is
concerned - see aws/jsii#523). However in the CloudFormation domain,
`null` is semantically equivalent to `undefined`.

Now enters Javascript's confusing type system, where `null` is an
`object` that cannot be converted to `object` (you read this correctly):

```js
typeof null === 'object'
// => true

Object.entries(null);
// => Thrown:
//    TypeError: Cannot convert undefined or null to object
//        at Function.entries (<canonymous>)
```

So this changes the `undefined` checks to the `null`-coercing way, so
that `null` and `undefined` are handled the same way.

Fix a bug that generates invalid Java docstrings, fixing the build.

See CHANGELOG

…-environment CodePipelines. (#1924)

Introduces a new type, `PhysicalName`, that represents the physical ID of resources, and adds it to `IResource`.

Adds a `ResourceIdentifiers` class that is supposed to be used inside the Construct Library.

Introduces a concept of a late-bound name, that is automatically generated by the framework if a given resource is used in a cross-environment fashion. Implements it in IAM's Role, CodeBuild's Project, and S3's Bucket.

Adds logic to the CodePipeline construct that automatically generates a Role with a physical name if an Action backed by a resource from a different account is added to it.

BREAKING CHANGE:
* iam: `roleName` in `RoleProps` is now of type `PhysicalName`
* s3: `bucketName` in `BucketProps` is now of type `PhysicalName`
* codebuild: `roleName` in `RoleProps` is now of type `PhysicalName`

…hangelog (#2814)

Batch permissions are automatically implied when given regular API call
permissions. For example, giving IAM permissions to `sqs:SendMessage`
gives permission to call both `SendMessage` and `SendMessageBatch`.

Fixes #2381.

As per offline discussions within the team, updating L3 constructs to be consistent across ECS/Fargate launch types as well as within the module itself.

LoadBalancedServices for both ECS and Fargate support the same properties.
QueueWorkerService have been renamed to QueueProcessingService.
Updated unit tests and added missing tests.
Updated README and design docs

BREAKING CHANGE: Renamed QueueWorkerService for base, ec2 and fargate to QueueProcessingService, QueueProcessingEc2Service, and QueueProcessingFargateService.

Tokens are now represented by the interface `IResolvable`. The class `Token`
still exists, but it is used to hold static routines for token encoding
(`Token.asString()`).

Actual token use is split into 2 categories:

- *Intrinsics*, represented by static methods on `Token`: these are to represent values
  that will be understood by the deployment language formalism (e.g.
  CloudFormation), and can be used to escape language type checking.
- *Lazy values*, represented by a `Lazy` class with static factories:
  these will be used to represent type-checked but lazily-produced
  values (evaluated at synthesis time).

In order to be JSII-compatible (which does not currently support
lambdas), `Lazy.stringValue()` et. al. take an interface with a single
method instead of a function.

Also changed in this commit: shoring up property names for encoded
tokens in classes like `CfnParameter` and `CfnElement`.

* `.stringValue` => `.valueAsString`, etc so `.value`, `.valueAsString`,
  `.valueAsList` etc. group together in autocomplete.
* `.ref` now returns a Token, `.refAsString` returns the stringified
  version that token.

To match the other standard the latter should actually be `.refAsString`
but `.ref` is used in so many places that this might be uncomfortable?

Fixes #1933.

BREAKING CHANGES:

* `Token` can no longer be instantiated. You probably want to use 
  `Lazy.stringValue` and others, or `Token.asString()` and others.
* `Token.isToken()`/`Token.unresolved()` => `Token.isUnresolved()`.
* `CfnOutput`: remove `.ref`, since they can't be referenced anyway.
* `CfnParameter`: rename `.stringValue` => `.valueAsString` (and
  similar for lists and numbers).
* `.ref` now returns an `IToken`, use `.refAsString` to get a
  string-encoded Token.
* `TokenMap` is now no longer exported, some parts of its functionality
  are available through the static `Tokenization` class.
* `IResolvedValuePostProcessor` => `IResolvableWithPostProcess`.

In accordance with new guidelines, we're centralizing cross-service
integrations into their own package. In this case, centralizing
SNS Subscribers into @aws-cdk/aws-sns-subscribers.

BREAKING CHANGE: using a queue, lambda, email, URL as SNS Subscriber now
requires an integration object from the `@aws-cdk/aws-sns-subscribers`
package.

…tructs that have been renamed. (#2816)

Originally, the version check TTL file was located alongside the CDK
node installation directory. This caused issues for people who had CDK
installed on a readonly filesystem.

This change moves this file to the user's home directory, specifically
under $HOMEDIR/.cdk/cache. This directory is already being used by
account-cache.ts.

The old logic is maintained where a repo check is run once a day against
NPM, when a CDK command is invoked, and when a new version is present
will generate a console banner notifying the user of this.

The edge case with the updated implementation is when there are 2+
active installations of CDK and they are used interchangably. When
this happens, the user will only get one notification per non-latest
installation of CDK per day.

The `BaseService` class had a `metric()` implementation missing the `clusterName` dimension (it was
overriden in `Ec2Service` with a correct implementation).

Moved correct `metric()`, `metricCpuUtilization()` and `metricMemoryUtilization()` methods to
`BaseService`. Both `Ec2Service` and `FargateService` now have correct `metricXxx()` methods.

Added tests for `metricXxx()` methods.

Grant the given identity permissions to start an execution of a
state machine (`states:StartExecution`).

BREAKING CHANGE: The CLI no longer accepts `--rename`, and the stack
                 names are now immutable on the stack artifact.

Fixes #2670