AWS S3 Server Access Logging does not support logging to buckets that
use SSE-KMS, only to buckets without default encryption or to buckets
that use SSE-S3. At least in some cases, this misconfiguration can be
caught within the CDK (when logging to the same bucket or when the
target bucket is using a KMS CMK).

This will still fail to catch scenarios where the target bucket is using
SSE-KMS using a KMS-managed key because the `encryptionKey` property is
not set on the Bucket in that scenario.

This may be a breaking change for some users; what is currently a mostly
silent misconfiguration will become an error when synthesizing.