(aws-cloudtrail): setting up cloudtrail with exisiting Bucket and KMS produces error "Incorrect Bucket Policy"

### Describe the bug

Setting up Cloudtrail with existing bucket and KMS gives an error "incorrect bucket policy"

### Expected Behavior

it should succeed with access to bucket logs

### Current Behavior

PythonCfnParameterStack: creating CloudFormation changeset...
11:14:13 AM | UPDATE_FAILED | AWS::CloudTrail::Trail | CloudTrailA62D711D
Resource handler returned message: "Invalid request provided: Incorrect S3 bucket policy is detected for bucket: mytestbucket1503 (Service: CloudTrail, Statu
s Code: 400, Request ID: 808ae11e-fb26-42f6-8563-53ead2deb86e)" (RequestToken: 4beb64bc-05a4-bcac-0f7a-7775a622cea2, HandlerErrorCode: InvalidRequest)

❌ PythonCfnParameterStack failed: Error: The stack named PythonCfnParameterStack failed to deploy: UPDATE_ROLLBACK_COMPLETE: Resource handler returned message: "Invalid request provided: Incorrect S3 bucket policy is detected for bucket: mytestbucket1503 (Service: CloudTrail, Status Code: 400, Request ID: 808ae11e-fb26-42f6-8563-53ead2deb86e)" (RequestToken: 4beb64bc-05a4-bcac-0f7a-7775a622cea2, HandlerErrorCode: InvalidRequest)
at FullCloudFormationDeployment.monitorDeployment (/usr/local/lib/node_modules/aws-cdk/lib/index.js:443:10232)
at process.processTicksAndRejections (node:internal/process/task_queues:95:5)
at async Object.deployStack2 [as deployStack] (/usr/local/lib/node_modules/aws-cdk/lib/index.js:446:153546)
at async /usr/local/lib/node_modules/aws-cdk/lib/index.js:446:136809

❌ Deployment failed: Error: The stack named PythonCfnParameterStack failed to deploy: UPDATE_ROLLBACK_COMPLETE: Resource handler returned message: "Invalid request provided: Incorrect S3 bucket policy is detected for bucket: mytestbucket1503 (Service: CloudTrail, Status Code: 400, Request ID: 808ae11e-fb26-42f6-8563-53ead2deb86e)" (RequestToken: 4beb64bc-05a4-bcac-0f7a-7775a622cea2, HandlerErrorCode: InvalidRequest)
at FullCloudFormationDeployment.monitorDeployment (/usr/local/lib/node_modules/aws-cdk/lib/index.js:443:10232)
at process.processTicksAndRejections (node:internal/process/task_queues:95:5)
at async Object.deployStack2 [as deployStack] (/usr/local/lib/node_modules/aws-cdk/lib/index.js:446:153546)
at async /usr/local/lib/node_modules/aws-cdk/lib/index.js:446:136809

The stack named PythonCfnParameterStack failed to deploy: UPDATE_ROLLBACK_COMPLETE: Resource handler returned message: "Invalid request provided: Incorrect S3 bucket policy is detected for bucket: mytestbucket1503 (Service: CloudTrail, Status Code: 400, Request ID: 808ae11e-fb26-42f6-8563-53ead2deb86e)" (RequestToken: 4beb64bc-05a4-bcac-0f7a-7775a622cea2, HandlerErrorCode: InvalidRequest)

### Reproduction Steps

Code is provided in the ticket. Repro'd issue with adding the policy manually -

testbucket = s3.Bucket.from_bucket_attributes(self, "MyTestBucket", bucket_name="mytestbucket1503",
bucket_arn="arn:aws:s3:::mytestbucket1503",)

iamrole = iam.Role(self, "MyRoleBucket",assumed_by=iam.ServicePrincipal('cloudtrail.amazonaws.com'))

iamrole.add_to_policy(iam.PolicyStatement(
effect=iam.Effect.ALLOW,
resources=[testbucket.bucket_arn],
actions=["s3:GetBucketAcl"],
conditions={"StringEquals": {"s3:x-amz-acl": "bucket-owner-full-control"}},
))

iamrole.add_to_policy(iam.PolicyStatement(
effect=iam.Effect.ALLOW,
resources=['*'],
actions=["s3:PutObject"],
))

trail= cloudtrail.Trail(self, "CloudTrail",
send_to_cloud_watch_logs=True,
bucket=testbucket,
)

### Possible Solution

_No response_

### Additional Information/Context

_No response_

### CDK CLI Version

2.95.1

### Framework Version

_No response_

### Node.js Version

v18.12.1

### OS

mac

### Language

Python

### Language Version

_No response_

### Other information

_No response_

Start at the cloudtrail.Trail entry point with the imported S3 bucket shown in the reproduction, and inspect how an existing bucket and KMS configuration are handled. Reproduce the CloudFormation deployment failure and compare the generated bucket policy with CloudTrail's requirements. Done means the existing-bucket setup deploys successfully without the Incorrect S3 bucket policy error.

Written by the indexing model from the issue text.