cloudwatchlogs-with-dlq: support optional kms key for encrypting sns topics

[bobziuchkovski]

Currently the SNS topics created by these templates are unencrypted. This PR adds optional encryption for the topics when a KMS key id is specified. This id can be the literal id, or something like alias/aws/sns. This is a non-breaking change. Existing CloudFormation stacks that are updated with this template will produce no changes unless the SNSTopicKMSKey parameter is explicitly specified.