Document KMS key policy requirements for SOPS decryption

[Copilot]

This PR adds comprehensive documentation for KMS key policy requirements to address decryption failures when the Lambda function cannot access the KMS key used by SOPS.

Problem

While this CDK construct grants the Lambda execution role broad KMS permissions (kms:*) via IAM policies, KMS key policies are resource-based policies that can override IAM permissions. If the KMS key policy doesn't explicitly allow the Lambda execution role to decrypt, SOPS decryption will fail at runtime.

Solution

Added a new "KMS Key Policy Requirements" section to the README that includes:

• Clear explanation of why both IAM and KMS key policies must allow access
• Required KMS permissions (kms:Decrypt, kms:DescribeKey)
• Example key policy statement with specific role ARN
• Instructions for finding the Lambda execution role ARN
• Alternative approach using conditions for more flexible access control

Example Usage

Users can now add a policy statement like this to their KMS key:

{
  "Sid": "AllowSopsSecretsManagerLambda",
  "Effect": "Allow",
  "Principal": {
    "AWS": "arn:aws:iam::ACCOUNT-ID:role/LAMBDA-EXECUTION-ROLE-NAME"
  },
  "Action": [
    "kms:Decrypt",
    "kms:DescribeKey"
  ],
  "Resource": "*"
}

This documentation provides users with actionable guidance to prevent SOPS decryption failures due to insufficient KMS key policy permissions.

Fixes #46.

---

💬 Share your feedback on Copilot coding agent for the chance to win a $200 gift card! Click here to start the survey.

[plumdog]

Make it clearer that this is the minimum permissions that should be granted for this construct to function correctly.

[Copilot]

Updated the text to clarify that these are the minimum permissions required for the construct to function correctly. (d9054b9)

[plumdog]

Add here the simplest approach, which is to just delegate all permissions for the KMS key over to IAM, then suggest the others as more refined alternatives. So work from simplest (and least secure) to more complex (but more secure).

[Copilot]

Restructured the KMS key policy documentation to start with the simplest approach (delegating all permissions to IAM) and progress to more secure alternatives. The three approaches are now ordered from least to most secure with clear security considerations for each. (commit: c5d45f2)