kms.Key: When custom policy is provided, key.grant doesn't always add to key policy

### Describe the bug

In our organization, the default policy of KMS construct that allows everything for the account is not acceptable. Instead we prefer to have something that allows admins and the deployer role to do management actions but not actually encryption related actions, therefore we set the keys similar to the following:

```
key = kms.Key(
self,
id,
alias=alias,
enable_key_rotation=True,
policy=iam.PolicyDocument(),
)

key.add_to_resource_policy(
iam.PolicyStatement(
actions=[
"kms:CancelKeyDeletion",
"kms:Create*",
"kms:Delete*",
"kms:Describe*",
"kms:Disable*",
"kms:Enable*",
"kms:Get*",
"kms:List*",
"kms:Put*",
"kms:Revoke*",
"kms:ScheduleKeyDeletion",
"kms:TagResource",
"kms:UntagResource",
"kms:Update*",
],
principals=[deployer_principal, admin_principal],
resources=["*"],
)
)
```

However due to `@aws-cdk/aws-kms:defaultKeyPolicies` feature flag that we can't turn off, KMS assume we have default policy of KMS that allows the account principals for everything. `trustAccountIdentities` must be also set to `true`.

This is problematic because now `.grant` methods rely on that assumption to not grant on the resource policy when it's not cross account.

### Regression Issue

- [ ] Select this option if this issue appears to be a regression.

### Last Known Working CDK Version

_No response_

### Expected Behavior

.grant modify the resource policy when the action is not allowed.

### Current Behavior

.grant not modifying the resource policy when the action is not allowed.

### Reproduction Steps

1. Define a key with a custom policy document that allows nothing.
2. Call key.grant with a same-account principal
3. Check key policy to see that nothing has been added.

### Possible Solution

_No response_

### Additional Information/Context

_No response_

### CDK CLI Version

v2.171.0

### Framework Version

_No response_

### Node.js Version

Nodejs 22

### OS

Mac

### Language

Python

### Language Version

_No response_

### Other information

_No response_

Start at the KMS construct's key.grant handling and the @aws-cdk/aws-kms:defaultKeyPolicies feature flag, then trace how a custom empty policy and same-account principal are evaluated. Reproduce the issue with the provided steps; done means the grant adds the required statement to the key policy when the action is not already allowed.

Written by the indexing model from the issue text.