fix(core): correct return type of Fn.getAtt (aws#3559)

* fix(core): correct return type of Fn.getAtt

This was still typed as `Token` but that has become a static helper host
a couple of versions ago. The actual return time is `IResolvable`. It
compiled in **TypeScript** since `Token` declares no instance members,
thus allowing any object to structurally cast to it -- however this
would not work in strong statically typed languages such as Java, where
this incurs an invalid cast.

* whitelist the API breaking change

allowed-breaking-changes.txt

@@ -0,0 +1 @@
+change-return-type:@aws-cdk/core.Fn.getAtt

packages/@aws-cdk/core/lib/cfn-fn.ts

@@ -20,9 +20,9 @@ export class Fn {
    * @param attributeName The name of the resource-specific attribute whose
    * value you want. See the resource's reference page for details about the
    * attributes available for that resource type.
-   * @returns a CloudFormationToken object
+   * @returns an IResolvable object
    */
-  public static getAtt(logicalNameOfResource: string, attributeName: string): Token {
+  public static getAtt(logicalNameOfResource: string, attributeName: string): IResolvable {
     return new FnGetAtt(logicalNameOfResource, attributeName);
   }