Fix regression in STS endpoint for SOPS decryption with AWS KMS in US Gov partition

[matheuscscp]

Fixes #1477

In kustomize-controller 1.6.0 a new logic was introduced for getting the AWS region from the KMS key ARN that did not account for the aws-us-gov and aws-cn ARN partitions. This logic would produce errors like the one below, where arn is mistakenly used as the region extracted by GetRegionFromKMSARN() in the STS endpoint:

STS: AssumeRoleWithWebIdentity, https response error\n   StatusCode: 0, RequestID:
, request send failed, Post\n \"https://sts.arn.amazonaws.com/\": dial tcp:
lookupts.arn.amazonaws.com on 10.100.0.10:53: no such host

The endpoint comes out as https://sts.arn.amazonaws.com/, when it should be something like https://sts.us-gov-west-1.amazonaws.com/.

This PR fixes the issue by using the same regex that SOPS uses for extracting the region.

[stealthybox]

Commented some nits, but overall LGTM

[stealthybox]

matching KMS as a service name here also validates the ARN

Partition name is enforced to have an aws* prefix which supports all of the current documented partitions

Notably, we could get the region with SplitN : 4, but matching the sops behavior also makes sense

[matheuscscp]

Yeah for this fix I'd like to just match SOPS, we can rethink this down the line

[fluxcdbot]

Successfully created backport PR for release/v1.6.x:

• [release/v1.6.x] Fix regression in STS endpoint for SOPS decryption with AWS KMS in US Gov partition #1480