[ECS Managed Instances] [request]: Configure EBS encryption for Managed Instances data volumes

### Community Note

* Please vote on this issue by adding a 👍 [reaction](https://blog.github.com/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/) to the original issue to help the community and maintainers prioritize this request
* Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
* If you are interested in working on this issue or have submitted a pull request, please leave a comment

**Tell us about your request**

Add an encryption configuration option (enable/disable, plus KMS key selection) to `storageConfiguration` on an ECS Managed Instances capacity provider, so that the EBS volumes ECS creates for Managed Instances can be encrypted without relying on an account-wide default.

**Which service(s) is this request for?**

ECS (Amazon ECS Managed Instances)

**Tell us about the problem you're trying to solve. What are you trying to do, and why is it hard?**

The EBS volumes that ECS creates for Managed Instances are unencrypted, and the capacity provider API gives no way to change that. `storageConfiguration` accepts only `storageSizeGiB`. There is no encryption flag and no way to specify a KMS key.

For any workload with a requirement that all block storage be encrypted at rest, this makes Managed Instances non-compliant with no in-band remedy. The only control point is outside ECS entirely.

This is also inconsistent with the rest of ECS's EBS support: task-attached EBS volumes configured at deployment (`configuredAtLaunch`) already accept `encrypted` and `kmsKeyId`. The Managed Instances host volume does not.

**Are you currently working around this issue?**

Yes, by turning on EBS encryption by default at the AWS account level. That works, but it is a blunt instrument:

* It changes behaviour for every EBS volume in the account, not just the ones ECS creates.
* It requires a configuration change outside the service that owns the resource, which is easy to miss when a new account is set up.
* It cannot express a per-capacity-provider or per-cluster policy.

**Additional context**

Related request for other missing `storageConfiguration` fields on Managed Instances: IOPS and throughput configuration (filed separately).

**Attachments**

None.

No repository files or tests are named. Start by reviewing the ECS Managed Instances capacity-provider storageConfiguration and compare it with the existing configuredAtLaunch EBS settings; done means the API supports enabling or disabling encryption and selecting a KMS key for Managed Instances data volumes.

Written by the indexing model from the issue text.