fix: remove ViaService condition from KMS alias creation policy

The ViaService condition restricting alias creation to EC2 would prevent
Terraform from creating the KMS alias. Keeping only the CallerAccount
condition allows principals in the account to create aliases while
maintaining proper account scoping.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <[email protected]>

Author: johncblandii

src/kms.tf

@@ -96,11 +96,6 @@ data "aws_iam_policy_document" "cloudtrail_kms_key_policy" {
       variable = "kms:CallerAccount"
       values   = [local.aws_account_id]
     }
-    condition {
-      test     = "StringEquals"
-      variable = "kms:ViaService"
-      values   = ["ec2.${var.region}.amazonaws.com"]
-    }
   }
 }