CloudTrail: encrypt SNS topic with KMS, add topic policy + email subscription

[Manideep3969]

Changes

• SNS topic KMS encryption: CloudTrail SNS topic now uses the confidential KMS key (kms_master_key_id = var.kms_key_arn)
• SNS topic policy: Added aws_sns_topic_policy allowing CloudTrail service to publish to the topic, with AWS:SourceArn condition for security
• Email subscription: Added aws_sns_topic_subscription for security-team@npci.org.in
• KMS policy for SNS: Added AllowSNSAccess statement to the confidential KMS key policy so SNS can encrypt/decrypt
• Output: Added cloudtrail_sns_topic_arn output

Compliance

• CKV_AWS_36 (log file validation) — already enabled
• CKV_AWS_252 (SNS topic for CloudTrail) — now properly secured with encryption + policy
• CKV2_AWS_10 (CloudWatch integration) — already configured

Testing

• terraform validate passes
• Unit tests: 171 passed
• CI: all checks expected to pass