Deploy backend for Studio fails at PutBucketEncryption due to Control Tower Guardrail

### Before opening, please confirm:

- [X] I have checked to see if my question is addressed in the [FAQ](https://github.com/aws-amplify/amplify-hosting/blob/master/FAQ.md).
- [X] I have [searched for duplicate or closed issues](https://github.com/aws-amplify/amplify-hosting/issues?q=is%3Aissue+).
- [X] I have read the guide for [submitting bug reports](https://github.com/aws-amplify/amplify-hosting/blob/master/CONTRIBUTING.md).
- [X] I have done my best to include a minimal, self-contained set of instructions for consistently reproducing the issue.

### App Id

dnvd7x2jn2npj

### Region

us-east-1

### Amplify Hosting feature

Not applicable

### Describe the bug

During a new deployment when I create a new backend it fails. I'm using SSO and Control Tower and tracked down the issue. To eliminate any other permission questions I'm logged in as the AWSReservedSSO_AdministratorAccess with these rights:
` {
"Effect": "Allow",
"Action": "*",
"Resource": "*"
}`

Digging into CloudTrail I found the cause:
` "eventSource": "s3.amazonaws.com",
"eventName": "PutBucketEncryption",
"sourceIPAddress": "cloudformation.amazonaws.com",
"userAgent": "cloudformation.amazonaws.com",
"errorCode": "AccessDenied",
"errorMessage": "Access Denied",
"requestParameters": {
"bucketName": "amplify-amplify##########-staging-#####-deployment",
"Host": "amplify-amplify#######-staging-######-deployment.s3.us-east-1.amazonaws.com",
"encryption": ""
}
`

AWS Control Tower has a guardrail that is optionally set
> Guardrail: Disallow Changes to Encryption Configuration for Amazon S3 Buckets

That guardrail creates a SCP that disallows s3:PutBucketEncryption on this account.

### Expected behavior

Don't call PutBucketEncryption if not using encryption. I am able to create a bucket with the guardrail in place fine, just unable to call this API.

If there's a reason it must be called then fail with a more graceful error? It's hard to track this down to the SCP given that with Control Tower we can't view the SCPs even as Administrator.

### Reproduction steps

1. Create Amplify app
2. Push to git provider
3. Set up Amplify New App, host web app, point to git created above
4. Go to backend environments
5. Get Started / Setup

### Build Settings

```yaml
N/A
```

### Additional information

Work around:

- In your main Control Tower Account
- Go to Guardrails
- Search for "Disallow Changes to Encryption Configuration for Amazon S3 Buckets"
- Disable this on the account you are deploying to

NOTE: The guardrail can be re-enabled after you have set up the backend (at least so far).

Start by tracing the backend setup deployment and its CloudFormation S3 bucket encryption call, then reproduce the failure with the Control Tower guardrail enabled and inspect the CloudTrail error. Done means the deployment avoids the forbidden PutBucketEncryption call when encryption is not needed, or reports a clear actionable error.

Written by the indexing model from the issue text.