added support for custom kms keys

[DanBehrman-CR]

No description provided.

[VirtueMe]

Hi @DanBehrman-CR — thanks for working on this, KMS encryption support is a real gap (tracked in #391).

A couple of notes on the approach here:

• The kms:Decrypt,kms:Encrypt value is a comma-separated string — IAM requires these to be separate array entries, so this would produce a malformed policy statement.
• No tests were added.

More importantly, the KMS IAM permission half of this PR was already incorporated into the recent #711 refactor — when encryptionConfig.KmsKeyId is set on a state machine, compileIamRole.js now correctly emits kms:Decrypt and kms:Encrypt as separate actions against that key ARN.

The remaining work from this PR — the compileStateMachines schema additions and the CloudFormation EncryptionConfiguration mapping — is the right direction and will be picked up as part of a proper fix for #391. Closing this draft to keep the queue clean, but the work won't be lost.