s3: grant method call on imported value fails with invalid ARN

### Describe the bug

I have an IAM group defined and exported in another stack.

In another stack I import the value and create a Group with `from_group_arn()`, then call `grant_read_write(group.grant_principal)` which fails with

```
"An ARN in the specified key policy is invalid."
```
However, if instead I simply pass the ARN into `from_group_arn()` as direct string, with the exact same ARN value as exported, the grant succeeds.

Code:

```
imported_value = Fn.import_value("S3Users")
s3_usersi = Group.from_group_arn(self, "ImportedGroup", imported_value)
s3_users = Group.from_group_arn(self, "MyGroup", "arn:aws:iam::123456789012:group/S3Users")

b = Bucket(self, "Bucket",
block_public_access=BlockPublicAccess.BLOCK_ALL,
encryption=BucketEncryption.KMS,
encryption_key=kms.key,
enforce_ssl=True,
versioned=True,
# removal_policy=RemovalPolicy.RETAIN
# only during testing!
removal_policy=RemovalPolicy.DESTROY
)
# succeeds
b.grant_read_write(s3_users.grant_principal)
# fails
# b.grant_read_write(s3_usersi.grant_principal)
```

The other stack's Output shows the value correctly exported:

```
ExportS3Users arn:aws:iam::123456789012:group/S3Users - S3Users
```

### Expected Behavior

The imported value should be a valid ARN which will give an `IGrantable` object.

### Current Behavior

See error above. The full message is

```
Resource handler returned message: "An ARN in the specified key policy is invalid. (Service: Kms, Status Code: 400, Request ID: b0d84d76-adb1-4810-bc30-64af25609682)" (RequestToken: 2c40f84f-9a2c-de4c-374b-308b725ed5e7, HandlerErrorCode: InvalidRequest)
```

### Reproduction Steps

see code above.

### Possible Solution

_No response_

### Additional Information/Context

_No response_

### CDK CLI Version

2.63.2

### Framework Version

_No response_

### Node.js Version

14.21.2

### OS

Centros 8

### Language

Python

### Language Version

3.9.5

### Other information

_No response_

Start with the provided Python reproduction, comparing Group.from_group_arn() when given Fn.import_value("S3Users") versus the literal ARN. Inspect the generated grant and KMS key policy around grant_principal and grant_read_write, then verify that the imported ARN produces the same valid policy as the literal value.

Written by the indexing model from the issue text.