(aws-kms): (Need cross-account ability in Alias construct)

### Describe the feature

Hi,
In order to grant permission to KMS key from another account, I need to use `Alias` to grant permission. But neither `KeyLookupOptions` nor `AliasAttributes` accepts accountId as input. I need any of these types to accept accountId as input so that I can create `Alias` that grant permission based on alias and accountId combination to the resource (say S3 bucket).

### Use Case

I need to grant permission to my lambda function to read S3 objects from account X that are encrypted using KMS key from same account X.

I cannot use current CDK lookup functions like Key, Alias types to do that. Because, they do not accept accountId as input.

### Proposed Solution

I should be able to do,

```
const alias = Alias.fromAliasAttributes(scope, id, {
'aliasName': 'alias/customXYZ',
'accountId': 'X',
});

alias.grantDecrypt(lambdaExecutionRole);
```

CDK should use `aws:ResourceAccount` as one of IAM condition key in the generated policy to restrict the permission to account `X`.

### Other Information

_No response_

### Acknowledgements

- [ ] I may be able to implement this feature request
- [ ] This feature might incur a breaking change

### CDK version used

1.0, 2.0

### Environment details (OS name and version, etc.)

All