fix(cloudformation): scope KMS key rotation check to symmetric keys

[arpitjain099]

Closes #7337

Reason for Proposed Changes

• The CloudFormation query KMS Key Rotation Disabled (kms_enable_key_rotation_disabled) reports a false positive on KMS keys that cannot use automatic rotation. Both CxPolicy blocks fire whenever EnableKeyRotation is false or missing on any AWS::KMS::Key, regardless of the key type.
• AWS automatic key rotation only applies to symmetric encryption keys whose key material was generated by KMS. Per the AWS::KMS::Key documentation, rotation applies only to KeySpec: SYMMETRIC_DEFAULT. Asymmetric, HMAC, and EXTERNAL-origin keys must have EnableKeyRotation omitted or set to false, so flagging them is incorrect.
• This matches the maintainer assessment in the issue. As @cx-artur-ribeiro confirmed: "key rotation only applies to KeySpec: SYMMETRIC_DEFAULT. For asymmetric, HMAC, or EXTERNAL origin keys, the EnableKeyRotation property should be omitted or explicitly set to false ... It's currently checking EnableKeyRotation == false without validating the key type."

Proposed Changes

• Add a rotation_eligible guard to both CxPolicy blocks so the query only fires for keys that actually support automatic rotation: KeySpec equal to SYMMETRIC_DEFAULT or absent (the default), and Origin not equal to EXTERNAL. The Origin check excludes symmetric keys with imported key material, which also cannot be rotated automatically.
• Add negative fixtures that must not be flagged: an asymmetric RSA_2048 key with rotation off, an asymmetric ECC_NIST_P256 key with no EnableKeyRotation property, an HMAC_256 key with rotation off, and a SYMMETRIC_DEFAULT key with Origin: EXTERNAL (YAML and JSON).
• Add a positive fixture (positive4.yaml) confirming symmetric keys with KeySpec: SYMMETRIC_DEFAULT (including an explicit Origin: AWS_KMS) and rotation disabled are still flagged, and update positive_expected_result.json.

Verification: go test ./test/ -run 'TestQueries$/cloudFormation/aws/kms_enable_key_rotation_disabled' plus the TestQueriesContent (100% query coverage) and TestQueriesMetadata cases all pass. Reverting only query.rego while keeping the new fixtures makes the four new negative cases fail (they get flagged), which confirms the guard is what removes the false positives.

I submit this contribution under the Apache-2.0 license.