Let user provide full KMS Key ARN, take 3

[toothbrush]

Description

(this is yet another approach to #1422 and #1424 - pick the one you prefer 😅)

We have a use case where we want to have a single KMS key that Buildkite agents in multiple accounts can use to sign and verify pipeline steps. By letting the user specify the whole key ARN rather than just the key ID, the user is free to use a key wherever they want.

This third attempt has a different set of tradeoffs to the previous two:

• non-breaking change - this template will accept the same parameter as before, but the user can provide either the Key ID part or the full ARN, better than Allow user to specify full KMS key ARN for pipeline signing. #1422's breaking change
• slightly less complex conditional and one less parameter - having to check that either-or Key ID or ARN are provided made Allow ARN to be provided for pipeline signing KMS key #1424 a bit unwieldy