secretsmanager: Grant decrypt for CMK of imported secret

Permissions to decrypt key of **imported** secret encrypted with CMK are not granted. If creating the key within the stack permissions are granted. Permissions are granted in the resource policy for Secrets Manager and the role and in role's attached policies. In this case, there are no policies created that give the role access.

### Reproduction Steps

```typescript
import * as iam from '@aws-cdk/aws-iam';
import * as kms from '@aws-cdk/aws-kms';
import * as sm from '@aws-cdk/aws-secretsmanager';
import * as cdk from '@aws-cdk/core';

class Stack extends cdk.Stack {
constructor(scope: cdk.Construct, id: string, props?: cdk.StackProps) {
super(scope, id, props);

const key = kms.Key.fromKeyArn(
this,
'MyKey',
'arn:aws:kms:ap-southeast-2:123412341234:key/1234abcd-12ab-34cd-56ef-1234567890ab',
);
const secret = sm.Secret.fromSecretAttributes(this, 'MySecret', {
secretArn: 'arn:aws:secretsmanager:ap-southeast-2:123412341234:secret:mysecret-ASDzxc',
encryptionKey: key,
});

const role = new iam.Role(this, 'MyRole', {
assumedBy: new iam.AccountPrincipal('123412341234'),
});
secret.grantRead(role);
}
}

const app = new cdk.App();
new Stack(app, 'MyStack');
```

### What did you expect to happen?

Permissions to decrypt associated encryption key are still granted to the role.

### What actually happened?

Permission to decrypt is not granted. Allowed actions are only to get secret value.

### Environment

- **CLI Version : 1.59.0**
- **Framework Version: 1.61.0**
- **Node.js Version: v14.9.0**
- **OS : macOS 10.13.3**
- **Language (Version): TypeScript (3.8.3)**

### Other

---

This is :bug: Bug Report

Start in aws-secretsmanager's Secret.fromSecretAttributes and grantRead path, then inspect how the imported KMS key is handled. Reproduce the TypeScript example and compare synthesized IAM policies for an imported secret versus a stack-created key; done when grantRead includes decrypt permission for the associated CMK.

Written by the indexing model from the issue text.