(aws-synthetics): support customer-managed KMS key for canary environment variable encryption

### Describe the feature

`AWS::Synthetics::Canary` exposes a top-level `KmsKeyArn` property that encrypts the
canary's Lambda function environment variables at rest with a customer-managed KMS key.
The `Canary` L2 construct currently provides no way to set it — users must drop down to
the L1 `CfnCanary` or use escape hatches.

This is distinct from the existing `artifactS3KmsKey` prop, which encrypts canary
artifacts in S3 (`ArtifactConfig.S3Encryption.KmsKeyArn`), not the environment variables.

### Use Case

Teams with compliance requirements to use customer-managed keys (CMKs) for all
data-at-rest need to encrypt canary environment variables (which can hold configuration
and sensitive values) with their own KMS key rather than the default AWS-managed key.

### Proposed Solution

Add an optional `environmentVariablesEncryptionKey?: kms.IKey` prop to `CanaryProps`,
wire it to `CfnCanary.kmsKeyArn`, and grant the canary execution role `kms:Decrypt` on
the key so the underlying Lambda can read its environment variables.

### Other Information

Follow-up: `AWS::Synthetics::Canary` also has a per-replica `Replicas[].KmsKeyArn` for
the multi-location canary feature. That will be addressed in a separate PR once the L2
models `Replicas`.

A PR implementing the top-level property is already open.

### Acknowledgements

- [x] I may be able to implement this feature request
- [x] This feature might incur a breaking change

### AWS CDK Library version (aws-cdk-lib)

2.268.0

### AWS CDK CLI version

2.1140.0

### Environment details (OS name and version, etc.)

OS: Amazon Linux 2023 (2023.7.20250623) Kernel: Linux 6.1.182-227.379.amzn2023.x86_64 Architecture: x86_64 Node.js: v24.18.0

Start at the CanaryProps entry point and the Canary L2 construct, then inspect how artifactS3KmsKey is wired to distinguish it from environment-variable encryption. The change is complete when an optional environmentVariablesEncryptionKey maps to CfnCanary.kmsKeyArn and the canary execution role receives kms:Decrypt; the top-level property is separate from replica support.

Written by the indexing model from the issue text.