stepfunctions: ItemReader and ResultWriter do not grant KMS permissions

### Describe the bug

Generally, states added to a state machine will grant all necessary policy permissions to the execution role of the state machine. When using the `DistributedMap` construct, however, the necessary permissions for working with encrypted buckets are left out.

### Regression Issue

- [ ] Select this option if this issue appears to be a regression.

### Last Known Working CDK Version

_No response_

### Expected Behavior

The step function should grant necessary KMS permissions on its returned policies.

### Current Behavior

The step function does not grant necessary KMS permissions on its returned policies. Example error:

> Failed to write a test manifest into the specified output bucket. Access denied. Ensure the correct permissions are added to your state machine's execution role. | Message from S3: User: is not authorized to perform: kms:GenerateDataKey on resource: because no identity-based policy allows the kms:GenerateDataKey action

### Reproduction Steps

```ts
const inputBucket = new Bucket('DistributedMapInputBucket', {
encryption: BucketEncryption.KMS,
enfoceSSL: true
});
const outputBucket = new Bucket('DistributedMapOutputBucket', {
encryption: BucketEncryption.KMS,
enfoceSSL: true
});
new StateMachine(this, 'Test', {
definitionBody: DefinitionBody.fromChainable(new DistributedMap(this, 'Map', {
itemReader: new S3JsonItemReader({
bucket: inputBucket,
key: "some-object"
}),
resultWriter: new ResultWriter({
bucket: outputBucket,
prefix: "some-prefix"
}),
}).itemProcessor(new Pass(this, 'pass'))
});
```

### Possible Solution

[ResultWriter](https://github.com/aws/aws-cdk/blob/d1b3c817676df87d24ad1b97af9b304f7c8526a3/packages/aws-cdk-lib/aws-stepfunctions/lib/states/distributed-map/result-writer.ts#L69) and [ItemReader](https://github.com/aws/aws-cdk/blob/d1b3c817676df87d24ad1b97af9b304f7c8526a3/packages/aws-cdk-lib/aws-stepfunctions/lib/states/distributed-map/item-reader.ts#L276) should add key read/write actions to their `providePolicyStatements` (both linked), similar to `Bucket.grantRead` and `Bucket.grantWrite` [here](https://github.com/aws/aws-cdk/blob/dcb5cf1130529231fe8c86265115bd18f7b1efb9/packages/aws-cdk-lib/aws-s3/lib/bucket.ts#L770-L781)

### Additional Information/Context

_No response_

### CDK CLI Version

2.164.1

### Framework Version

_No response_

### Node.js Version

18

### OS

macOS

### Language

TypeScript

### Language Version

_No response_

### Other information

_No response_

Start with packages/aws-cdk-lib/aws-stepfunctions/lib/states/distributed-map/item-reader.ts and result-writer.ts, focusing on their providePolicyStatements methods, and compare them with Bucket.grantRead and Bucket.grantWrite in packages/aws-cdk-lib/aws-s3/lib/bucket.ts. Done means the generated execution-role policies include the necessary KMS permissions when DistributedMap reads from or writes to encrypted buckets.

Written by the indexing model from the issue text.