(aws-appconfig): Policy from `SqsDestination` does not grant access to queue's encryption key

### Describe the bug

The `SqsDestination` used with an AWS AppConfig extension does not grant permissions to read from an SQS queue encrypted with a customer-managed key.
https://github.com/aws/aws-cdk/blob/6b318f53bbaa1d79ffa8fcdfc3b321d49c8fdd43/packages/aws-cdk-lib/aws-appconfig/lib/extension.ts#L101-L108

### Regression Issue

- [ ] Select this option if this issue appears to be a regression.

### Last Known Working CDK Library Version

_No response_

### Expected Behavior

Users would expect the SQS destination for AppConfig to work without additional effort in the CDK code: the policy document provided by `SqsDestination` should include a policy statement for accessing the queue's encryption key.

### Current Behavior

The IAM role used by the event action is missing the policy statement for the queue's encryption key, so the event action will not be able to send messages to the destination queue.

### Reproduction Steps

Add an SQS destination for an encrypted queue to an AppConfig application:
```ts
const key = new kms.Key(this, "MyKey");
const queue = new sqs.Queue(this, "MyQueue", { encryptionMasterKey: key });

const application = new appconfig.Application(this, "MyApp");
application.onDeploymentComplete(new appconfig.SqsDestination(queue));
```
Observe the generated role does not have permissions for the encryption key:
```yaml
MyAppExtension8693CRole10911697645ED:
Type: AWS::IAM::Role
Properties:
AssumeRolePolicyDocument:
Statement:
- Action: sts:AssumeRole
Effect: Allow
Principal:
Service: appconfig.amazonaws.com
Version: "2012-10-17"
Policies:
- PolicyDocument:
Statement:
- Action: sqs:SendMessage
Effect: Allow
Resource:
Fn::GetAtt:
- MyQueueE6CA6235
- Arn
Version: "2012-10-17"
PolicyName: AllowAppConfigInvokeExtensionEventSourcePolicy
```

Deploy the resources, complete an AppConfig deployment to trigger the extension, and observe the queue does not receive any messages.

### Possible Solution

Add another policy for the encryption key if present
```ts
if (queue.encryptionMasterKey) {
policy.addStatements(
new PolicyStatement({
actions: ["kms:Decrypt", "kms:GenerateDataKey"],
resources: [queue.encryptionMasterKey.keyArn],
})
);
}
```

### Additional Information/Context

_No response_

### AWS CDK Library version (aws-cdk-lib)

2.208.0

### AWS CDK CLI version

2.1024.0

### Node.js Version

N/A

### OS

N/A

### Language

TypeScript

### Language Version

_No response_

### Other information

_No response_

Start at packages/aws-cdk-lib/aws-appconfig/lib/extension.ts around lines 101-108 and reproduce the issue with the encrypted SQS queue example. Verify that the generated AppConfig role policy grants access to the queue's customer-managed encryption key, then confirm the deployed extension can send messages after an AppConfig deployment.

Written by the indexing model from the issue text.