fix(eks): let the provisioner decrypt the storage bucket's objects

[Brad-Edwards]

Problem

The aws-dev post-deploy smoke fails in content delivery:

range reached terminal status failed (...): cloud_operation_failed: raes range provision failed (RaesContentDeliveryError)

The provisioner IRSA role may s3:GetObject the storage bucket (provisioner-iam s3-agent-read) but holds no grant on the bucket's SSE-KMS key (alias/shifter-<env>-portal-s3). Downloading any delivered payload (pack content, recipe-acquired feature artifacts) therefore fails. The simulator showed kms:Decrypt as implicitDeny for the role. NGFW bootstrap uploads to the same bucket (s3-bootstrap-write) lacked kms:GenerateDataKey for the same reason.

Change

• provisioner-iam takes a required agent_s3_kms_key_arn and grants kms:Decrypt and kms:GenerateDataKey on exactly that key, conditioned on kms:ViaService = s3.<region>.amazonaws.com.
• eks-provisioner-env resolves the key from the portal storage alias and passes it in.

Verification

• terraform test -filter=tests/native_ec2.tftest.hcl in provisioner-iam passes, with a new run pinning the statement to the key, the two actions, and the S3 via-service condition.
• terraform validate passes for eks-provisioner-env.
• IAM simulator: both actions allowed under the role's permissions boundary; the key policy delegates to account IAM.
• Live: aws-dev redeploy with this change is running.

Refs #2463