kms-rotation-audit — flag KMS keys with rotation disabled before an auditor does

AWS KMS customer-managed keys don't rotate unless you turn it on — audit for keys with rotation disabled and fail CI before a compliance auditor flags them.