Fix disposeKeys logic in aws_kms KeyManager plugin

[amartinezfayo]

This change updates the disposeKeys function aws_kms KeyManager plugin to use prefix matching instead of exact equality when checking if a key belongs to the trust domain.
The previous logic (Description != prefix) only matched keys with descriptions exactly equal to SPIRE_SERVER_KEY/{trust_domain}, excluding keys with additional path components. The new logic (!strings.HasPrefix(Description, prefix)) correctly identifies all keys belonging to the trust domain, including those with extra path segments like SPIRE_SERVER_KEY/{trust_domain}/extra.

Thanks @moe-omar for pointing this in #5497.

The test suite was updated to fix a data race where the test directly accessed the key entries map without proper synchronization, now using the thread-safe ListKeyEntries() method instead, and adjusted to wait for all expected deletion signals before asserting results.

[sorindumitru]

LGTM