Support for Decrypting S3 Objects Encrypted with SSE-KMS

### Describe the feature

When Amazon SES is configured to save incoming emails to an S3 bucket, it offers an option to encrypt the email object using an AWS KMS key.

This gem should be able to handle such encrypted emails. When fetching the email from S3, it should detect if the object is encrypted and, if so, use the appropriate AWS SDK mechanisms to decrypt it before passing the content to Action Mailbox for processing. This decryption process should be transparent to the end-user of the gem.

### Use Case

For security and compliance reasons, many applications require that all data at rest be encrypted, including emails stored temporarily in S3 buckets. When setting up an SES rule to deliver emails to S3, enabling server-side encryption with KMS (SSE-KMS) is a common practice.

Without decryption support in this gem, we cannot use it in projects that have this encryption requirement. Any email received via SES is stored in its encrypted form, which causes Action Mailbox to fail when it tries to parse the content.

### Proposed Solution

The implementation should leverage the AWS SDK for Ruby. The SDK provides a client for S3 that can handle client-side decryption for objects that were encrypted with a KMS-managed key.

The proposed logic would be:
* Before downloading the full S3 object, check its metadata for encryption information (e.g., `x-amz-matdesc`).
* If encryption metadata is present, use the S3 encryption client from the AWS SDK to download and decrypt the object. The KMS key required for decryption is specified in the object's metadata.
* If no encryption metadata is found, the gem should proceed as it currently does, using the standard S3 client.

This approach ensures backward compatibility for users who do not use S3 encryption.

### SDK version used

v0.1.0

Trace the gem's S3 fetch path and how it passes downloaded email content to Action Mailbox. Read the AWS SDK for Ruby S3 and encryption-client documentation, then compare metadata-based decryption with the existing standard S3 download path. Done means SSE-KMS-encrypted SES objects are decrypted transparently while unencrypted objects continue using the current behavior.

Written by the indexing model from the issue text.