Unable to Use Plan Storage with SSE-Protected S3 Bucket

### Describe the Feature

Due to security policies, all of our S3 buckets need to include a bucket policy that denies any attempts to upload objects that do not include server-side encryption (SSE). I believe that technically you don't need to do this if you configure the default encryption time in the bucket's settings. Nevertheless, sometimes it's difficult to justify changes in security requirements in my organization. I suspect I am not alone in this.

When trying to use this Github Action, it will fail to upload the plan to the S3 bucket.
```
AccessDenied: User: arn:aws:sts::REDACTED:assumed-role/REDACTED/atmos-terraform-state-gitops is not authorized to perform: s3:PutObject on resource: "arn:aws:s3:::$BUCKET/$GITHUB-ORG/cloud-infrastructure/6749c018ca0124fb8ea2822b72eab6bd083f30be/vpc/myStacktfplan" with an explicit deny in a resource-based policy
```

I have confirmed that the IAM role being used _does_ have the proper permissions for the S3 bucket. However, I believe the "resource-based policy" is the requirement to include the following S3 bucket policy.
```json
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "DenyIncorrectEncryptionHeader",
"Effect": "Deny",
"Principal": {
"AWS": "*"
},
"Action": "s3:PutObject",
"Resource": "arn:aws:s3:::gha-terraform-infra/*",
"Condition": {
"StringNotEquals": {
"s3:x-amz-server-side-encryption": [
"AES256",
"aws:kms"
]
}
}
},
{
"Sid": "DenyUnEncryptedObjectUploads",
"Effect": "Deny",
"Principal": {
"AWS": "*"
},
"Action": "s3:PutObject",
"Resource": "arn:aws:s3:::gha-terraform-infra/*",
"Condition": {
"Null": {
"s3:x-amz-server-side-encryption": "true"
}
}
},
]
}
```

### Expected Behavior

When using the `atmos-terraform-plan` Github Action, it should be able to store the plan on an S3 bucket using a designated encryption method during the upload if it is necessary.

### Use Case

This is making it difficult to integrate Atmos with Github Actions for our team. I could remove the aforementioned S3 bucket policies, but inevitably it would show up on a security scan. I would like our team to embrace Atmos for its positives. I can disable plan storage for now, but that won't help us in the long-term.

### Describe Ideal Solution

In the past with other tools or libraries (e.g. boto3), we've had to make sure we include an argument or flag that specifies the use of server-side encryption. Since it may be difficult to remove this bucket policy due to organization requirements and since I can't imagine I'm the only one out there with this problem, I think it would be good to have an additional argument or flag to specify SSE for plan storage.

### Alternatives Considered

_No response_

### Additional Context

If this feature request is accepted and someone needs to reproduce this problem, you can do the following.

- Create a new S3 bucket with the bucket policy mentioned earlier.
- Set up OIDC per the Atmos documentation and configure the bucket as your plan storage.
- Create a simple Github Workflow:
```yaml
name: 👽 Atmos Terraform Plan (Manual)
run-name: 👽 Atmos Terraform Plan (Manual)

on:
workflow_dispatch:
inputs:
component:
description: "The name of the Terraform component."
required: true
type: string
stack:
description: "The name of the Atmos stack."
required: true
type: string

permissions:
id-token: write
contents: read

jobs:
atmos-plan:
name: "Atmos Terraform Plan"
runs-on: polaris-ops-uswest2
steps:
- name: Plan Atmos Component
uses: cloudposse/github-action-atmos-terraform-plan@v5
with:
component: ${{ inputs.component }}
stack: ${{ inputs.stack }}
atmos-version: ${{ vars.ATMOS_VERSION }}
plan-storage: true
```

Start with the atmos-terraform-plan action's plan-storage input and locate the S3 upload path used by the workflow shown in the issue. Reproduce against an S3 bucket with the provided encryption-deny policy, then verify that a designated SSE method is sent during upload and that the plan succeeds without weakening the bucket policy.

Written by the indexing model from the issue text.