Allow CMKs and bucket keys

[allan-thatch]

Add support for using customer-managed KMS keys and bucket keys for encryption.

[oleg-render]

Great addition! Our current s3 bucket policy will actually block KMS-encrypted uploads because it requires AES256 encryption. When using KMS, the encryption type is "aws:kms".
If using KMS we should not include that constraint (replace with aws:kms) and enforce kms keys with conditions:

condition = {                                                                                                                                                                                                
  StringEquals = {                                                                                                                                                                                                                                                              
  "s3:x-amz-server-side-encryption" = "aws:kms"                                                                                                                                                                
  },                                                                                                                                                                                                           
  Null = {                                                                                                                                                                                                     
  "s3:x-amz-server-side-encryption-aws-kms-key-id" = "true"                                                                                                                                                    
  }                                                                                                                                                                                                            
}

[allan-thatch]

Great catch! Thank you!