aws provider 4 & require-private-acl-and-kms-for-s3-buckets fails on new s3 buckets

[Zambonilli]

We're seeing failures in the require-private-cl-and-kms-for-s3-buckets policy fail in sentinel for new s3 buckets after upgrading to aws provider 4. Looking at the code, we believe it is because the terraform plan output in 0.13.7 runtime for aws provider 4 produces a plan result where server_side_encryption_configuration is linked to new resource objects as opposed to embedding the object. Which causes the "computed" clause here to fail.

https://github.com/hashicorp/terraform-guides/blob/master/governance/second-generation/aws/require-private-acl-and-kms-for-s3-buckets.sentinel#L83