fix(s3): decrypt SSE-KMS bodies for internal object readers

[Sorttech]

Problem

Objects in an SSE-KMS bucket are stored as a fakecloud-kms envelope, and only the S3 API's own read paths unwrapped it. Every internal reader took the stored bytes straight off S3 state:

• the CloudFormation provisioner hydrating Lambda Code.S3Bucket/Code.S3Key;
• the S3Delivery hook Lambda pulls S3-sourced code through on UpdateFunctionCode;
• CloudFormation's TemplateURL fetch, both for a top-level stack and for a nested AWS::CloudFormation::Stack;
• the provisioner's pinned-version read (Step Functions DefinitionS3Location.Version).

cdk bootstrap gives its assets bucket default aws:kms encryption, so this breaks CDK deploys in three ways:

1. A Lambda deployed from a CDK asset received the base64 envelope in place of its ZIP and failed at invoke time with ZIP extraction failed: invalid Zip archive: Could not find EOCD. On the same 859-byte asset, CodeSize was 1252 (the envelope) instead of 859.
2. The CDK CLI always uploads the template, so TemplateURL resolved to the envelope. It is base64 ASCII, so it survived from_utf8, passed the non-empty guard and parsed as a template with no resources: the stack reported CREATE_COMPLETE having provisioned nothing.
3. Nested-stack templates also live in that bucket; the child template failed to parse and the parent went CREATE_FAILED.

Fix

The unwrap moves into fakecloud_s3::sse::decrypt_body. The provisioner's three S3 readers (current object, pinned version, nested-stack template; all via one read_object_body), the top-level TemplateURL fetch, the S3 delivery hook and S3Service::decrypt_object_body all go through it, so the service no longer carries its own copy and a new reader cannot forget it.

It fails closed: a decrypt that errors with a hook wired returns Err rather than passing the envelope on, which is how the corruption reached Lambda in the first place.

The provisioner and the CloudFormation service reuse the kms_hook they already carry (added in faiscadev#2598); the hook is also wired into S3DeliveryImpl.

Tests

• E2E cfn_lambda::cfn_creates_lambda_function_from_sse_kms_s3_code asserts CodeSize and CodeSha256 against the plaintext and fails without the fix (172 vs 48). The existing cfn_creates_lambda_function_from_s3_code uses an unencrypted bucket, so it never covered this.
• E2E cloudformation::cfn_reads_a_template_url_from_an_sse_kms_bucket asserts the stack actually provisions its resources.
• E2E cloudformation::cfn_reads_a_nested_stack_template_from_an_sse_kms_bucket went CREATE_FAILED with the fix reverted and passes with it.
• Unit tests for each provisioner reader against a body stored as a real KMS envelope (the version and nested-template ones returned the envelope before the fix).
• Unit tests for sse::decrypt_body: unencrypted pass-through, decrypt, no hook wired, a non-UTF-8 pre-hook body, and a failed decrypt returning an error.

Verified locally: build, cargo fmt --all --check, clippy -D warnings on s3/cloudformation/server, unit suites (cloudformation 528, s3 500, server 124), and all three E2E tests.