Add KMS Key to Cloudwatch Log Group

**Is your feature request related to a problem? Please describe.**
Ability to add custom kms key to cloudwatch log group

**Describe the solution you'd like**
Since Cloudwatch can encrypt logs groups at creation time ([link](https://repost.aws/knowledge-center/cloudwatch-encrypt-log-data)). I would like the ability pass in the key by alias so that the log group created by the agent is encrypted

**Describe alternatives you've considered**
Create the cloudwatch group outside of the agent as a pre-step

**Additional context**
n/a

Start by tracing where the agent creates CloudWatch log groups and how its configuration is parsed. Identify the configuration and test locations for supplying a KMS key alias, then verify that newly created log groups use the requested key while existing-group behavior remains clear.

Written by the indexing model from the issue text.