fix(sagemaker): correct Risk for transient volume encryption key

SageMaker uses a transient key (discarded after encryption) when
VolumeKmsKeyId is omitted for processing and batch transform ML
storage volumes, not an AWS managed KMS key. Update both check
metadata Risk fields accordingly while keeping the CMK recommendation.

Author: elecelias-ux

prowler/providers/aws/services/sagemaker/sagemaker_processing_job_volume_encrypted_with_cmk/sagemaker_processing_job_volume_encrypted_with_cmk.metadata.json

@@ -13,7 +13,7 @@
   "ResourceType": "Other",
   "ResourceGroup": "ai_ml",
   "Description": "**Amazon SageMaker processing jobs** are assessed for **at-rest encryption** of their attached ML storage volumes using a **customer-managed KMS key**. The finding reflects whether `ProcessingResources.ClusterConfig.VolumeKmsKeyId` is set on the job.",
-  "Risk": "A processing job without `VolumeKmsKeyId` falls back to an **AWS managed key**, which cannot carry a custom key policy and whose **rotation**, **access** and **lifecycle** are outside the account owner's control. Intermediate processing data on the volume then cannot be independently revoked, and grants to that data cannot be audited or restricted through a key policy.",
+  "Risk": "When `VolumeKmsKeyId` is omitted, SageMaker encrypts the processing job ML storage volume with a **transient key** and discards it immediately after encryption, not an AWS managed KMS key. That transient key cannot carry a custom key policy, so **rotation**, **access**, and **lifecycle** remain outside the account owner's control. Intermediate processing data on the volume then cannot be independently revoked, and grants to that data cannot be audited or restricted through a key policy. Configure `VolumeKmsKeyId` when customer-managed key policy and audit controls are required.",
   "RelatedUrl": "",
   "AdditionalURLs": [
     "https://docs.aws.amazon.com/sagemaker/latest/dg/key-management.html",

prowler/providers/aws/services/sagemaker/sagemaker_transform_job_volume_encrypted_with_cmk/sagemaker_transform_job_volume_encrypted_with_cmk.metadata.json

@@ -13,7 +13,7 @@
   "ResourceType": "Other",
   "ResourceGroup": "ai_ml",
   "Description": "**Amazon SageMaker transform jobs** are assessed for **at-rest encryption** of their attached ML storage volumes using a **customer-managed KMS key**. The finding reflects whether `TransformResources.VolumeKmsKeyId` is set on the job.",
-  "Risk": "A transform job without `VolumeKmsKeyId` falls back to an **AWS managed key**, which cannot carry a custom key policy and whose **rotation**, **access** and **lifecycle** are outside the account owner's control. Intermediate inference data on the volume then cannot be independently revoked, and grants to that data cannot be audited or restricted through a key policy.",
+  "Risk": "When `VolumeKmsKeyId` is omitted, SageMaker encrypts the batch transform job ML storage volume with a **transient key** and discards it immediately after encryption, not an AWS managed KMS key. That transient key cannot carry a custom key policy, so **rotation**, **access**, and **lifecycle** remain outside the account owner's control. Intermediate inference data on the volume then cannot be independently revoked, and grants to that data cannot be audited or restricted through a key policy. Configure `VolumeKmsKeyId` when customer-managed key policy and audit controls are required.",
   "RelatedUrl": "",
   "AdditionalURLs": [
     "https://docs.aws.amazon.com/sagemaker/latest/dg/key-management.html",