Use of KMS keys across nested stacks create circular dependencies

I have a separate nested stack that creates and associates security related resources including IAM resources and KMS CMKs. Let's refer to this nested stack as `SecurityNestedStack`.

I have a nested stack which contains lambdas and SQS queues. Let's refer to this nested stack as `LambdaNestedStack`.

These queues are using KMS CMKs and using an IAM role from `SecurityNestedStack`. Everything for the role and cmk has been preconfigured in `SecurityNestedStack` including policies for SQS IAM access, KMS IAM access, and CMK key policy.

Setting up the [SQSEventSource](https://github.com/aws/aws-cdk/blob/0f0e2055cab08551bc6e5dfb8a1b6219368263c5/packages/%40aws-cdk/aws-lambda-event-sources/lib/sqs.ts#L27) in `LambdaNestedStack` calls [`grantConsumeMessages`](https://github.com/aws/aws-cdk/blob/0f0e2055cab08551bc6e5dfb8a1b6219368263c5/packages/%40aws-cdk/aws-sqs/lib/queue-base.ts#L164) which in turn adds two new IAM policies to the queue's IAM role. This happens in the wrong stack and causes a circular dependency.

This is helpful for ease of setting up events, roles, and key policies for the queue. It's problematic in more advanced use cases and larger stacks that must be split up (200 resource limit in stacks).

### Reproduction Steps

See above. I can post code if necessary.

### Error Log

CloudFormation reports that all nested stacks have circular dependencies. Not completely true but there is a circular dependency across nested stacks.

### Environment

- **CLI Version : 1.19.0**
- **Framework Version: 1.19.0**
- **OS : macOS**
- **Language : TypeScript**

### Other

My workaround right now is to call `addEventSourceMapping` and pass in `batchSize` and `eventSourceArn` myself OR import the role.

---

This is :bug: Bug Report

Start by reading packages/@aws-cdk/aws-lambda-event-sources/lib/sqs.ts and packages/@aws-cdk/aws-sqs/lib/queue-base.ts, focusing on SQSEventSource, grantConsumeMessages, and the policies added to the queue role. Reproduce the SecurityNestedStack and LambdaNestedStack arrangement, then verify that configuring the SQS event source no longer creates circular nested-stack dependencies while retaining the required permissions.

Written by the indexing model from the issue text.