aws-kms: add grant function for `kms:GenerateDataKey` && `kms:DecryptKey`

### Describe the feature

Its very common with sqs queues to require `kms:GenerateDataKey` && `kms:DecryptKey` to write to an encrypted queue. would be nice to have this in an easy to provision function.

### Use Case

[sqs docs with kms
](https://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/sqs-key-management.html)

### Proposed Solution

_No response_

### Other Information

_No response_

### Acknowledgements

- [x] I may be able to implement this feature request
- [ ] This feature might incur a breaking change

### CDK version used

2.x

### Environment details (OS name and version, etc.)

doesnt matter

The issue names aws-kms and an SQS encrypted-queue use case but no repository files or tests. Start with the linked SQS key-management documentation and the existing KMS grant APIs, then identify the matching CDK module and its tests. Done means the requested grant function is defined for the named permissions and covered by tests.

Written by the indexing model from the issue text.