Control: Ensure managed IAM policies should not allow blocked actions on KMS keys

This control is from a mod dependency: