example(dbaas): add PostgreSQL Flex with KMS encryption

[devpie]

Description

This PR adds examples/dbaas-postgresql-kms-encryption: a PostgreSQL Flex instance whose volume and backup storage are encrypted with a customer-managed STACKIT KMS key, together with the keyring, the key and the service account the database service uses to unwrap it.

The repository had no DBaaS example for customer-managed encryption, and the README documents the constraints that follow from it: the key version is fixed at create time, rotation does not re-encrypt existing data, and a backup can only be cloned while its key version is usable.

terraform validate passes against provider v0.115.0, and check_readme_tags.py, check_todos.py, check_terraform_numbered_files.py and generate_agents_md.py --check pass locally.

Please check whether assigning kms.admin to the database service account is acceptable for an example; the README points to iam-custom-roles for a role that carries only the decrypt and encrypt permissions.

Checklist

• The CI pipeline passed successfully.

[h3adex]

LGTM

[devpie]

Done