Update KMS PQ integration test to assert ML-KEM

[goatgoose]

Problem:

The KMS PQ integration test started failing because an unexpected KEM group was being negotiated. See #5082. It appears that some KMS hosts have been updated with a new security policy that supports ML-KEM, and the resulting kyber KEM group preference changed as a result of that.

Ideally we would update the integration test to negotiate ML-KEM and assert that ML-KEM was negotiated, but this was flaky when I tried it. I think some of the KMS hosts still only support the draft KEM groups. For now, the test just asserts that any KEM group was negotiated.

Solution:

After ML-KEM is fully supported, we should update the test to assert that ML-KEM was specifically negotiated.