(glue): Code.fromBucket should work with encrypted buckets

### Describe the feature

when using `glue.Code.fromBucket` to specify the `script` or `extraPythonFiles`, the L2 `glue.Job` construct automatically grants permissions to read from this bucket. however, if the bucket is encrypted, it doesn't take the extra step to grab permissions to use the required KMS key the decrypt the bucket contents

### Use Case

Internally at Amazon, we store stack assets in an account-wide encrypted bucket. I would like to simply pass in the bucket to the `glue.Job` construct and expect the permissions to be handled such that Glue can read from the provided bucket.

```typescript
new glue.Job(this, 'Job', {
executable: glue.JobExecutable.pythonEtl({
glueVersion: glue.GlueVersion.V3_0,
pythonVersion: glue.PythonVersion.THREE,
script: glue.Code.fromBucket(
props.barsBucket,
`${props.jobsLambdaAssetPrefix}/handlers/mygluejob.py`,
),
extraPythonFiles: [
glue.Code.fromBucket(
props.barsBucket,
`${props.jobsLambdaAssetPrefix}/artifact`,
),
],
}),
}),
```

### Proposed Solution

_No response_

### Other Information

_No response_

### Acknowledgements

- [ ] I may be able to implement this feature request
- [ ] This feature might incur a breaking change

### CDK version used

1.154.0 (build 0d1b77f)

### Environment details (OS name and version, etc.)

Amazon Linux 2

Start at the glue.Code.fromBucket and glue.Job entry points shown in the example, using an encrypted S3 bucket and the provided script or extraPythonFiles configuration. Check the permissions granted by the L2 glue.Job construct; done means Glue can read encrypted bucket contents with the required KMS key permissions.

Written by the indexing model from the issue text.