aws_secretsmanager: Make cross-account secret sharing easier with KMS Key alias

### Describe the feature

### Short description
I'd like a way to use secret.grantRead(role) that would automatically generate the appropriate policy using the alias condition for cross-account secret sharing**

### How it works without this feature
Let's say I have a secret in AccountA (111111111111) and what to share that with AccountB (222222222222).

#### Account A CDK Stack
```typescript
const encryptionKey = new kms.Key(this, "Key", {
alias = "mysecretkeyalias"
});

const secret = new secretsmanager.Secret(this, "Secret", {
encryptionKey: encryptionKey,
secretName: "MySecret"
});

const accountB = new iam.AccountPrincipal("222222222222");

secret.grantRead(accountB);
```

To consume this secret from AccountB, I'd need to grant access to both the secret and the kms key, but I'd like to use the alias instead of the key name for many reasons (easier configuration for multi-region for example as I wouldn't have to pass different key arns), which currently have to look something like this:
#### Account B CDK Stack
```typescript
const role = new iam.Role(this, "ConsumerRole", {
// Setup the role
});

const secret = secretsmanager.Secret.FromSecretAttributes(this, "Secret", {
secretPartialArn: "arn:aws:secretsmanager:us-east-1:11111111111:secret:MySecret"
});

secret.grantRead(role);

role.addToPrincipalPolicy({
resources: ["arn:aws:kms:us-east-1:11111111111:key/*"],
actions: ["kms:decrypt"],
conditions: {
"ForAnyValue:StringEquals": {
"kms:ResourceAliases": "alias/mysecretkeyalias",
},
},
}):
```

### Use Case

When it's not the same team/people/company owning the source AWS account and/or the secret/key as the consuming account, it would be convenient if it's possible to reference the key by alias to ease configuration as well as making it possible to switch kms key for the secret without having to change on the consuming side.

For multi-region deployments, it's also better as I'd not have to specify multiple secrets + kms keys, but could instead use the secret partialarn and the kms key alias, which could be the same across all regions.

### Proposed Solution

It would be nice if there was some way to specify the alias and that it would produce a policy with a kms key alias condition
```typescript
const role = new iam.Role(this, "ConsumerRole", {
// Setup the role
});

const kmsAlias = kms.Alias.FromAliasArn(this, "Alias", "arn:aws:kms:us-east-1:111111111111:alias/mysecretkeyalias");

const secret = secretsmanager.Secret.FromSecretAttributes(this, "Secret", {
encryptionKey: kmsAlias,
secretPartialArn: "arn:aws:secretsmanager:us-east-1:11111111111:secret:MySecret"
});

secret.grantRead(role);
```

Expected policy:
```
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"kms:Decrypt",
],
"Resource": [
"arn:aws:kms:us-east-1:11111111111:key/*",
],
"Condition": {
"ForAnyValue:StringLike": {
"kms:ResourceAliases": "alias/mysecretkeyalias"
}
}
}
]
}
```

### Other Information

I assume there could be side-effects with my proposed solution that could cause this feature to not be possible or a good solution

### Acknowledgements

- [x] I may be able to implement this feature request
- [X] This feature might incur a breaking change

### CDK version used

2.114.1

### Environment details (OS name and version, etc.)

Windows 11

Start by examining the secretsmanager.Secret.fromSecretAttributes and grantRead APIs, along with the proposed kms.Alias input. Trace how the existing cross-account secret and KMS policies are generated, then determine how alias conditions should be represented and tested. Done means grantRead produces the expected alias-conditioned KMS policy without requiring consumers to specify individual key ARNs.

Written by the indexing model from the issue text.