aws-stepfunctions-tasks: SNSPublish KMS permissions

### Describe the feature

When using [SnsPublish](https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_stepfunctions_tasks.SnsPublish.html), it would be good if the task included granting the permissions needed for publishing to topics using a CMK.

### Use Case

Convenience, furthermore this can sometimes get in the way of creating abstractions, for example needing to create and pass in the StateMachine role where tasks are created, or surface the SNS topic until the role is created.

### Proposed Solution

I see there is a place where permissions (in policies) are determined:

https://github.com/aws/aws-cdk/blob/6877c6a9807b3db17df204a54961df9c1a00387a/packages/aws-cdk-lib/aws-stepfunctions-tasks/lib/sns/publish.ts#L186-L192

I understand the complication would be that the topic does not have its [masterKey](https://github.com/aws/aws-cdk/blob/6877c6a9807b3db17df204a54961df9c1a00387a/packages/aws-cdk-lib/aws-sns/lib/topic.ts#L204) exposed.

This doesn't seem to be unusual, for example the SQS queue exposes the key used for encryption:

https://github.com/aws/aws-cdk/blob/6877c6a9807b3db17df204a54961df9c1a00387a/packages/aws-cdk-lib/aws-sqs/lib/queue.ts#L362-L363

So my proposal would be to expose the key in the Topic, and use it to define the `taskPolicies`.

Having said that, maybe other Tasks such as SendToQueue should also include the relevant EncryptDecrypt permissions.

https://github.com/aws/aws-cdk/blob/6877c6a9807b3db17df204a54961df9c1a00387a/packages/aws-cdk-lib/aws-stepfunctions-tasks/lib/sqs/send-to-queue.ts#L88-L91

### Other Information

_No response_

### Acknowledgements

- [X] I may be able to implement this feature request
- [ ] This feature might incur a breaking change

### CDK version used

2.167.1

### Environment details (OS name and version, etc.)

macOS Sonoma 14.7.1

Start in packages/aws-cdk-lib/aws-stepfunctions-tasks/lib/sns/publish.ts at the task policy logic, then inspect packages/aws-cdk-lib/aws-sns/lib/topic.ts where the master key is discussed. Compare the existing key exposure in aws-sqs and the policy logic in sqs/send-to-queue.ts. Done means CMK-encrypted SNS publishing receives the required permissions, with the related behavior verified by the project’s tests.

Written by the indexing model from the issue text.