Automatically Add kms:Decrypt to iamRoleStatements

[mccredie]

Is your feature request related to a problem? Please describe.
It is in the example. Basically, it is a step that needs to be performed, and the plugin could easily take care of it for you.

Describe the solution you'd like
The plugin will look at the referenced secrets and determine the ARNs for the CMKs used, and add role statements allowing the lambda kms:Decrypt using those CMKs

Describe alternatives you've considered
We could just print a warning, or fail the packaging command, if we detect that the required statement doesn't exist. This might actually be tricky to figure out.

Additional context
See the example in README.md for the required role statements.