fix(aws): narrow the CloudFormation KMS key/* grant to another account's keys

[tim-thacker-nullify]

KMSAccessPolicy granted arn:<partition>:kms:<region>:<account>:key/* next to NullifyKMSKeyArn unconditionally, so a customer who pasted a key ARN from their own account handed the role every KMS key in that account and region. #89 narrows Terraform to derive the wildcard only when the ARN's account differs from the deploying account; this brings the CloudFormation template in line.

• the policy is two statements: the supplied ARN always, and key/* in the ARN's account and region under StringNotEquals on aws:PrincipalAccount
• aws:PrincipalAccount is the account owning the role, always the deploying account, so the statement applies exactly when the ARN's account is not it
• NullifyKMSKeyArn's description, the KMSPolicyResource output description and the template README describe the gate

Not deploy-time parity

Terraform drops the wildcard from the policy document. CloudFormation cannot: condition functions accept only Fn::FindInMap, Ref and other condition functions, so the Fn::Select/Fn::Split that parses the account out of the ARN cannot appear inside Fn::Equals, and no Condition can gate a statement or an Fn::If resource list on it. AWS::LanguageExtensions adds Fn::ForEach, Fn::Length and Fn::ToJsonString only.

The wildcard resource therefore stays in the rendered document and is gated per request instead. Effective permissions match Terraform; the policy JSON does not.

Resulting grant

NullifyKMSKeyArn	Effective resources
Nullify alias ARN (...:111122223333:alias/x, stack in 999988887777)	the alias ARN (inert: IAM never resolves it) plus arn:aws:kms:<region>:111122223333:key/*
Nullify key ARN (...:111122223333:key/mrk-...)	that key plus arn:aws:kms:<region>:111122223333:key/*
Customer's own key ARN (...:999988887777:key/..., stack in 999988887777)	that key alone

Unverified

• no local run of cfn-lint, CloudFormation or IAM; CI's cfn-lint job is the check
• a customer-account alias ARN grants nothing, matching Terraform after fix(terraform): require KMS for the collector and narrow the key/* grant to cross-account #89 — the cross-account test is the only gate in both, and IAM ignores alias ARNs

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[tim-thacker-nullify]

Collapsed into #64 at f9903ac after passing adversarial review; all of this PR's commits are now in #64.