fix(ec2): support KMS encryption in SSM terminal sessions

[mrelgie88]

Problem:

EC2 Open Terminal invokes session-manager-plugin using its legacy argument format. When Session Manager KMS encryption is enabled, the plugin rejects the encryption handshake and reports that the installed CLI does not support encryption.

Solution:

• Use the complete modern session-manager-plugin invocation.
• Pass the StartSession target and effective SSM endpoint.
• Supply the Toolkit's resolved credentials to the plugin environment.
• Preserve the underlying terminal startup error for troubleshooting.
• Add unit coverage for the modern plugin argument format.

Testing:

• Core TypeScript compilation passes.
• Core webpack build completes.
• Focused EC2 tests pass: 18 passing, 1 platform-specific test pending on Windows.
• Verified locally through the Extension Development Host on Windows.
• Verified EC2 Open Terminal with Standard_Stream and a nonempty kmsKeyId.
• Verified commands execute successfully in the encrypted terminal.
• Verified closing the terminal terminates the SSM session.

Fixes #8840

---

• Treat all work as PUBLIC. Private feature/x branches will not be squash-merged at release time.
• Your code changes must meet the guidelines in CONTRIBUTING.md.
• License: I confirm that my contribution is made under the terms of the Apache 2.0 license.

[amazon-inspector-ohio]

⏳ I'm reviewing this pull request for security vulnerabilities and code quality issues. I'll provide an update when I'm done

[amazon-inspector-ohio]

✅ I finished the code review, and didn't find any security or code quality issues.