Cloud Formation - Bucket drift detection reports false BucketEncryption drift

### Name of the resource

AWS::S3::Bucket

### Resource Name

_No response_

### Issue Description

Region: eu-west-1
Account ID: 903883324733
Affected resource: arn:aws:cloudformation:eu-west-1:903883324733:stack/amplify-passwordresetportal-migration-d8622/06a289e0-9d61-11f1-b7d6-06d037bfc73b, logical resource amplify-passwordresetportal-migration-d8622-deployment (AWS::S3::Bucket)

Description:

Running DetectStackResourceDrift/DetectStackDrift on the above stack reports drift on the BucketEncryption property:
```
Property: /BucketEncryption
Deployed: "null"
Expected: "{"ServerSideEncryptionConfiguration":[{"ServerSideEncryptionByDefault":{"SSEAlgorithm":"AES256"}}]}"
```
This appears to be a false positive. Querying the bucket directly confirms encryption is correctly configured and matches what's expected:

```
$ aws s3api get-bucket-encryption --bucket amplify-passwordresetportal-migration-d8622-deployment
{
"ServerSideEncryptionConfiguration": {
"Rules": [
{
"ApplyServerSideEncryptionByDefault": {
"SSEAlgorithm": "AES256"
},
"BucketKeyEnabled": false,
"BlockedEncryptionTypes": {
"EncryptionType": ["SSE-C"]
}
}
]
}
}
```

### Expected Behavior

Running DriftDetection on this resource should provide no errors

### Observed Behavior

False positive validation

### Test Cases

Run ``amplify gen2-migration lock`` on an S3 bucket with default settings

### Other Details

_No response_

Reproduce the report with `amplify gen2-migration lock` on an S3 bucket with default settings, then compare CloudFormation drift output with `aws s3api get-bucket-encryption`. Done means DetectStackResourceDrift no longer reports BucketEncryption drift when the bucket's AES256 encryption matches the expected configuration.

Written by the indexing model from the issue text.