[AWS::BedrockAgentCore::Identity] - [coverage] - Add KmsConfiguration property for CMK encryption

### Name of the resource

Other

### Resource name

AWS::BedrockAgentCore::Identity

### Description

## Name of the resource
**Other**

## Resource name
**AWS::BedrockAgentCore::Identity**

## Description
Coverage Request for AWS::BedrockAgentCore::Identity

## Category
**(c) New attribute for an existing resource is desired**

## Resource
**AWS::BedrockAgentCore::Identity**

## Describe the scope of your request

### Current State
The AWS::BedrockAgentCore::Identity resource manages token vaults for storing OAuth tokens and credentials. However, there is no CloudFormation property to configure customer-managed KMS encryption.

Currently, token vault CMK encryption must be configured separately using:
- AWS CLI: `aws bedrock-agentcore-control set-token-vault-cmk`
- Boto3 SDK: `client.set_token_vault_cmk()`

This creates a deployment gap where infrastructure-as-code cannot fully configure the token vault's encryption settings.

### Requested New Attribute
Add a new `KmsConfiguration` property to the `AWS::BedrockAgentCore::Identity` resource that allows users to specify a customer-managed KMS key for token vault encryption.

### Proposed Property Structure
```yaml
Type: AWS::BedrockAgentCore::Identity
Properties:
# ... existing properties ...
TokenVaultId: String
KmsConfiguration:
KeyType: String # CustomerManagedKey or ServiceManagedKey
KmsKeyArn: String # Customer-managed KMS key ARN (required when KeyType=CustomerManagedKey)
```

### Use Case
Organizations with compliance requirements need to:
1. Use customer-managed KMS keys for all data encryption
2. Manage encryption configuration through CloudFormation/CDK
3. Ensure consistent encryption policies across all AWS resources
4. Enable key rotation and audit trails for OAuth tokens stored in Identity token vaults

### Current Workaround
Users must perform a two-step deployment:
1. Manually configure CMK encryption using AWS CLI or custom resources

This breaks the infrastructure-as-code workflow and requires additional orchestration.

### Expected Behavior
With the new attribute, users can configure token vault encryption directly in CloudFormation/CDK:

**CloudFormation:**
```yaml
TokenVault:
Type: AWS::BedrockAgentCore::TokenVault
Properties:
TokenVaultId: default
KmsConfiguration:
KeyType: CustomerManagedKey
KmsKeyArn: !GetAtt MyKmsKey.Arn
```

**CDK (Python):**
```python
token_vault = bedrockagentcore.CfnTokenVault(
self, "TokenVault",
token_vault_id="default",
kms_configuration=bedrockagentcore.CfnTokenVault.KmsConfigurationProperty(
key_type="CustomerManagedKey",
kms_key_arn=kms_key.key_arn
)
)
```

Related API: `bedrock-agentcore-control:SetTokenVaultCmk`

### Other Details

_No response_

Start with the AWS::BedrockAgentCore::Identity resource definition and the related SetTokenVaultCmk API. Verify how KmsConfiguration, KeyType, and KmsKeyArn should map into the CloudFormation resource and its documentation. Done means customer-managed token-vault encryption can be configured through CloudFormation/CDK without the CLI workaround.

Written by the indexing model from the issue text.