Allow CloudTrail encryption with SSE-S3

[wimnat]

Is your feature request related to a problem? Please describe.

Using this module will always create a KMS key in order to encrypt CloudTrail logs. This KMS key comes with a financial cost that the user has to pay.

Describe the solution you'd like

It should be possible to opt out of using SSE-KMS for CloudTrail logs. If the KMS parameter is not passed in the aws_cloudtrail resource, logs will still be encrypted using SSE-S3 but at no cost to the user.

Describe alternatives you've considered

None

Additional context

AWS docs describing how CloudTrail logs are encrypted - https://docs.aws.amazon.com/awscloudtrail/latest/userguide/encrypting-cloudtrail-log-files-with-aws-kms.html