2256 encrypt cloudtrail logs

[Matthew-Grayson]

🗣 Description

Enables KMS encryption of our Terraform-managed CloudTrail.

• Add kms_key_id to CloudTrail resource to enable encryption.
• Add CloudTrail kms policy; rename CloudTrail s3 policy.
• Refactor assume_role_policy to use jsonencode() for code readablitiy and IDE error checking.

💭 Motivation and context

See issue #2256
Related to CIS AWS Foundations Benchmark v1.4.0/3.7

🧪 Testing

✅ Pre-approval checklist

• This PR has an informative and human-readable title.
• Changes are limited to a single goal - eschew scope creep!
• All future TODOs are captured in issues, which are referenced
  in code comments.
• All relevant type-of-change labels have been added.
• I have read the CONTRIBUTING document.
• These code changes follow cisagov code standards.
• All relevant repo and/or project documentation has been updated
  to reflect the changes in this PR.
• Tests have been added and/or modified to cover the changes in this PR.
• All new and existing tests pass.

✅ Pre-merge checklist

• Revert dependencies to default branches.
• Finalize version.

✅ Post-merge checklist

• Create a release.

[aloftus23]

Looks good