High-level CloudFront Origin Access Identity (OAI) builder. **Use Case:** OAI allows CloudFront to access private S3 buckets without making them public. This is a security best practice for serving static content. **Note:** AWS recommends using Origin Access Control (OAC) instead of OAI for new applications. OAI is maintained for backward compatibility. **Escape Hatch:** Access the underlying CDK OriginAccessIdentity via the `Identity` property.