do not allow key= on decrypt with aws-kms master key provider

[mattsb42-aws]

Problem

When decrypting with the AWS KMS master key provider, specifying the master key does not functionally do anything useful because the master key provider mirrors the KMS service behavior in decrypting any encrypted data key protected by a KMS CMK for which the calling identity has appropriate access. Accepting key values in an AWS KMS master key provider configuration on decrypt creates the false image that only those keys will be used for decrypt.

Solution

Raise an argument parsing error if a key value is provided with an AWS KMS master key provider on decrypt.