fix(core): Stacks render CloudFormation elements in nested Stages (#10156)

In current recommended CDK Pipelines usage, the construct tree looks
like this:

```
App -> Stack1 -> Stage -> Stack2 -> Resource
```

It's an easy mistake to forget `Stack2` (or make it a generic
`Construct` instead), in which case the hierachy looks like the one
below and `Stack1` will render Resource in its CloudFormation template:

```
App -> Stack1 -> Stage -> Construct -> Resource
```

This case should not have been allowed in the first place: `Stage`s
define a new assembly scope and so `Stack1` does not exist from the
point of view of `Resource`.

Change `Stack.of()` to fail to find `Stack1` in this case, so
that it becomes illegal to define `Resource` in this position.

Fixes #9792, relates to #9669.


----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

Author: rix0rrr

packages/@aws-cdk/core/lib/stack.ts

@@ -169,8 +169,8 @@ export class Stack extends Construct implements ITaggable {
         return c;
       }
 
-      if (!c.node.scope) {
-        throw new Error(`No stack could be identified for the construct at path ${construct.node.path}`);
+      if (Stage.isStage(c) || !c.node.scope) {
+        throw new Error(`${construct.constructor?.name ?? 'Construct'} at '${construct.node.path}' should be created in the scope of a Stack, but no Stack found`);
       }
 
       return _lookup(c.node.scope);

packages/@aws-cdk/core/test/test.cfn-resource.ts

@@ -124,6 +124,35 @@ export = nodeunit.testCase({
       // No DependsOn!
     });
 
+    test.done();
+  },
+
+  'CfnResource cannot be created outside Stack'(test: nodeunit.Test) {
+    const app = new core.App();
+    test.throws(() => {
+      new core.CfnResource(app, 'Resource', {
+        type: 'Some::Resource',
+      });
+    }, /should be created in the scope of a Stack, but no Stack found/);
+
+
+    test.done();
+  },
+
+  /**
+   * Stages start a new scope, which does not count as a Stack anymore
+   */
+  'CfnResource cannot be in Stage in Stack'(test: nodeunit.Test) {
+    const app = new core.App();
+    const stack = new core.Stack(app, 'Stack');
+    const stage = new core.Stage(stack, 'Stage');
+    test.throws(() => {
+      new core.CfnResource(stage, 'Resource', {
+        type: 'Some::Resource',
+      });
+    }, /should be created in the scope of a Stack, but no Stack found/);
+
+
     test.done();
   },
 });

packages/@aws-cdk/core/test/test.stack.ts

@@ -747,7 +747,7 @@ export = {
   'Stack.of() throws when there is no parent Stack'(test: Test) {
     const root = new Construct(undefined as any, 'Root');
     const construct = new Construct(root, 'Construct');
-    test.throws(() => Stack.of(construct), /No stack could be identified for the construct at path/);
+    test.throws(() => Stack.of(construct), /should be created in the scope of a Stack, but no Stack found/);
     test.done();
   },