Add check for kms permissions for EBS Encryption to doctor command

[NickLavrov]

I deployed a RunsOn Flex stack with EbsEncryptionKey unset. Because our AWS account has EBS encryption by default enabled, EC2 still encrypted volumes with the account default KMS key — but -flex-role did not have permissions to use that key, so runner instances failed to launch. This was hard to spot from existing doctor output.

This PR adds a Flex-only check to roc stack doctor that resolves the EBS encryption key in use and verifies the flex role can access it.

Key resolution

• Reads EbsEncryptionKey from /runs-on//stack-config
• If unset, falls back to the account’s EBS default encryption settings (EC2 APIs)
• Resolves the key via KMS and displays alias/aws/ebs when it matches the AWS-managed default

IAM validation

• Inspects inline and attached managed policies on -flex-role
• Verifies the required KMS actions on the resolved key ARN:
  • Decrypt, DescribeKey, Encrypt, GenerateDataKey, GenerateDataKeyWithoutPlaintext, ReEncryptFrom, ReEncryptTo
  • CreateGrant with kms:GrantIsForAWSResource: true
• Reports the key in use and any missing permissions; Fleet stacks skip this check

Changes

• New internal/cli/doctor_ebs.go with key resolution and IAM policy evaluation
• Wired into StackDoctor.Run(); documented in README and command help
• Added EbsEncryptionKey to stack config parsing
• Unit tests for policy parsing, key resolution, and Fleet skip behavior
• Added kms SDK dependency

Test plan

• [ x ] go test ./internal/cli/ -run 'Doctor|FlexRole|EBS|IAM|KMS|ResolveEBS' -v

• [ x ] roc stack doctor --stack against a Flex stack with account default EBS encryption and confirm the check passes or reports missing KMS permissions

• Confirm Fleet stacks skip the check with ⏭️ (please test this with a fleet deployment if possible)

• [ x ] Confirm failure output lists the resolved key (e.g. alias/aws/ebs) and missing actions when permissions are incomplete