### Is there an existing issue for this?

- [X] I have searched the existing issues

### Current Behavior

LocalStack does not validate the KMS key when do S3 ops `put-object` or `get-object` even configured required environment variables:
```
environment:
      - PROVIDER_OVERRIDE_S3=asf
      - S3_SKIP_KMS_KEY_VALIDATION=0
```
Had similar issue here https://github.com/localstack/localstack/issues/7782 got resolved but still facing the problem. 

### Expected Behavior

LocalStack should throw either `KMS.DisabledException` or `KMS.KMSInvalidStateException` when `KeyState` is `Disabled` or `PendingDeletion`.

### How are you starting LocalStack?

With a docker-compose file

### Steps To Reproduce

#### How are you starting localstack (e.g., `bin/localstack` command, arguments, or `docker-compose.yml`)
docker-compose.yml

#### Client commands (e.g., AWS SDK code snippet, or sequence of "awslocal" commands)
1.  My LocalStack not pointing default `4566` so I have to do `export EDGE_PORT=<PORT>`.
2. Create the key in `ap-south-1` region:
```
awslocal kms create-key --description "byok confluence" --region ap-south-1
```
3. Get the above key `Arn` and export in env var: `export KEY_ID=<Arn>`

Now, I have two scenarios, one is disable the key and another is schedule the key deletion.

**Scenario 1**
1. Disable the key:
```
awslocal kms disable-key --key-id "$KEY_ID" --region ap-south-1
```
2. Run the command to confirm the key is disabled, i.e. `"KeyState": "Disabled"`:
```
awslocal kms describe-key --key-id "$KEY_ID" --region ap-south-1
```
Output: 
```
{
    "KeyMetadata": {
        "AWSAccountId": "000000000000",
        "KeyId": "f0e44ead-305f-4f7d-a492-e93ac8e9bda9",
        "Arn": "arn:aws:kms:ap-south-1:000000000000:key/f0e44ead-305f-4f7d-a492-e93ac8e9bda9",
        "CreationDate": 1685650954.265076,
        "Enabled": false,
        "Description": "byok confluence",
        "KeyUsage": "ENCRYPT_DECRYPT",
        "KeyState": "Disabled",
        "Origin": "AWS_KMS",
        "KeyManager": "CUSTOMER",
        "CustomerMasterKeySpec": "SYMMETRIC_DEFAULT",
        "KeySpec": "SYMMETRIC_DEFAULT",
        "EncryptionAlgorithms": [
            "SYMMETRIC_DEFAULT"
        ],
        "MultiRegion": false
    }
}
```
3. Calling `put-object` went through which is not expected since it needs to throw `KMS.DisabledException`:
```
awslocal s3api put-object --bucket <bucket-name> --key test.json --server-side-encryption aws:kms --ssekms-key-id "$KEY_ID" --body test.json
```
Output:
```
{
    "ETag": "\"d56d80665de6de5b29e9b5c9c907f02f\"",
    "ServerSideEncryption": "aws:kms",
    "VersionId": "1e9973de-eec2-4b69-bc5f-3b7492eb250c",
    "SSEKMSKeyId": "arn:aws:kms:ap-south-1:000000000000:key/f0e44ead-305f-4f7d-a492-e93ac8e9bda9"
}
``` 
Similarly calling `get-object` using `awslocal s3api get-object --bucket <bucket-name> --key test.json output.txt` went through no errors out.
 
**Scenario 2**
1. Schedule the key deletion:
```
awslocal kms schedule-key-deletion --key-id "$KEY_ID" --pending-window-in-days 7 --region ap-south-1
```
2. Run the command to confirm the key is pending deletion, i.e. `"KeyState": "PendingDeletion"`:
```
awslocal kms describe-key --key-id "$KEY_ID" --region ap-south-1
```
Output:
```
{
    "KeyMetadata": {
        "AWSAccountId": "000000000000",
        "KeyId": "f0e44ead-305f-4f7d-a492-e93ac8e9bda9",
        "Arn": "arn:aws:kms:ap-south-1:000000000000:key/f0e44ead-305f-4f7d-a492-e93ac8e9bda9",
        "CreationDate": 1685650954.265076,
        "Enabled": false,
        "Description": "byok confluence",
        "KeyUsage": "ENCRYPT_DECRYPT",
        "KeyState": "PendingDeletion",
        "DeletionDate": 1686256290.104983,
        "Origin": "AWS_KMS",
        "KeyManager": "CUSTOMER",
        "CustomerMasterKeySpec": "SYMMETRIC_DEFAULT",
        "KeySpec": "SYMMETRIC_DEFAULT",
        "EncryptionAlgorithms": [
            "SYMMETRIC_DEFAULT"
        ],
        "MultiRegion": false
    }
}
```
3. Similar to above scenario 1 no errors out when calling `put-object` and `get-object`.

### Environment

```markdown
- OS: Apple M1 Pro, 13.3.1 (a) (22E772610a).
- LocalStack: 1.4.0.
```


### Anything else?

_No response_
return {k: v for k, v in param.items() if k.startswith("x-amz") or k in ["content-type"]}
class TestS3:
    @pytest.mark.aws_validated
    @pytest.mark.xfail(
        condition=LEGACY_S3_PROVIDER,
        reason="exceptions not raised",
    )
    def test_replication_config_without_filter(
        self, s3_create_bucket, create_iam_role_with_policy, snapshot, aws_client
    ):
        snapshot.add_transformer(snapshot.transform.s3_api())
        snapshot.add_transformer(
            snapshot.transform.jsonpath(
                "$..ReplicationConfiguration.Role", "role", reference_replacement=False
            )
        )
        snapshot.add_transformer(
            snapshot.transform.jsonpath(
                "$..Destination.Bucket", "dest-bucket", reference_replacement=False
            )
        )
        bucket_src = f"src-{short_uid()}"
        bucket_dst = f"dst-{short_uid()}"