aws-cdk-lib/aws-events-targets: SqsQueue target not granting access to the KMS key

### Describe the bug

Using a EventBridge to SQS target. According to the documents, you must use a customer managed KMS key to encrypt your SQS quueue for EventBridge messages to be delivered to SQS.

I am creating an EventRules. My messages are being delivered to my queue, but not the dlq. I checked out the object in the AWS console. Both queues are granting SendMessage access to EventBridge. Howver, only the regular queue is getting access to the KMS Key. The DLQ key is not getting granting access to EventBrdige.

I manually granted access to the DLQ key to EventBridge and it then did get messages from EventBridge.

Code:
```
new events.Rule(this, 'rule', {
description: 'Rule to send events to SQS.',
eventBus: this,
eventPattern: {
source: events.Match.prefix('yyy'),
},
targets: [
new SqsQueue(queue, {
deadLetterQueue: dlq,
}),
],
});
```

### Regression Issue

- [ ] Select this option if this issue appears to be a regression.

### Last Known Working CDK Version

_No response_

### Expected Behavior

According to the docs, the key should be granting the following. Not sure this is exactly correct as the non-DLQ key is getting a few more actions. But something like this:

```
{
"Sid": "Allow EventBridge to use the key",
"Effect": "Allow",
"Principal": {
"Service": "events.amazonaws.com"
},
"Action": [
"kms:Decrypt",
"kms:GenerateDataKey"
],
"Resource": "*"
}
```

https://docs.aws.amazon.com/eventbridge/latest/userguide/eb-troubleshooting.html

### Current Behavior

The DLQ is granting access to SendMessage action to EventBridge, but it is not granted acces to the KMS Key.

### Reproduction Steps

```
import { SqsQueue } from 'aws-cdk-lib/aws-events-targets';

const dlq = new sqs.Queue(this, 'dlq', {
encryption: sqs.QueueEncryption.KMS_MANAGED,
encryptionMasterKey: new Key(this, 'dlqKey', {
alias: 'Dlq-key',
description: 'Used to encrypt/decrypt.',
enableKeyRotation: true,
removalPolicy: RemovalPolicy.DESTROY,
}),
retentionPeriod: Duration.days(14),
enforceSSL: true,
});

const queue = new sqs.Queue(this, 'queue', {
// Intentionally causing events to fail to be delivered to the queue
encryption: sqs.QueueEncryption.KMS_MANAGED,
retentionPeriod: Duration.days(14),
enforceSSL: true,
deadLetterQueue: {
queue:sqsDlq,
maxReceiveCount: 5,
},
});

new events.Rule(this, 'rule', {
description: 'Rule to send events to SQS.',
eventBus: this,
eventPattern: {
source: events.Match.prefix('yyy'),
},
targets: [
new SqsQueue(queue, {
deadLetterQueue: dlq,
}),
],
});
```

### Possible Solution

_No response_

### Additional Information/Context

_No response_

### CDK CLI Version

2.176.0

### Framework Version

_No response_

### Node.js Version

22

### OS

Mac

### Language

TypeScript

### Language Version

Typescript 5.7.2

### Other information

_No response_

Start at the SqsQueue entry point in aws-cdk-lib/aws-events-targets and trace how permissions are granted to the primary queue and dead-letter queue. Reproduce the example with an encrypted DLQ, then verify that the synthesized policies grant EventBridge the required KMS access for both queues.

Written by the indexing model from the issue text.