events: events.targets.SqsQueue with Custom KMS key grant too broad permission for a EventBridge rule to publish a message

### Describe the feature

If you add a SQS Queue as target for a rule it should automatically grant rights for the rule to publish messages to the SQS.
But when the Queue is encrypted with custom KMS key it grant permission for the eventbridge to put events on the queue.
But the permission is totally different compared when you have a queue with managed KMS key or when the queue is not encrypted. Also it's not restrictive enough!. This should be the same!.

See below:

Permission with custom KMS key:

"Resource": "arn:aws:sqs:eu-west-1:xxxxxxxxxxxxxxxxxxx:yyyyyyyy",
"Condition": {
"StringEquals": {
"aws:SourceAccount": "xxxxxxxxxxxxxxxxxxx"
}
}
}

Permission with managed KMS key or not encrypted at all:

"Resource": "arn:aws:sqs:eu-west-1:xxxxxxxxxxxxxxxxxxx:test",
"Condition": {
"ArnEquals": {
"aws:SourceArn": "arn:aws:events:eu-west-1:xxxxxxxxxxxxxxxxxxx:rule/test-bus/test-rule"
}
}

### Use Case

You should grant only the target rule permission to publish messages on the queue. No more no less!.

### Proposed Solution

_No response_

### Other Information

_No response_

### Acknowledgements

- [ ] I may be able to implement this feature request
- [ ] This feature might incur a breaking change

### CDK version used

v2.141.0

### Environment details (OS name and version, etc.)

Linux

Start at the events.targets.SqsQueue implementation and inspect how it grants EventBridge permission for queues encrypted with a custom KMS key. Compare that policy with the managed-key and unencrypted cases described in the issue; done means the custom-key policy restricts publishing to the specific EventBridge rule without broadening access.

Written by the indexing model from the issue text.