feat: Revise metrics filter for UnauthorizedAttemptsAlarm.

[tkimurz]

Exclude calls “Decrypt" event by config.amazonaws.com to ignore innocuous errors caused by AWS Config.
That error occurs when Lambda function has a KMS (CMK) encrypted environment variable.

Sample error logged in CloudTrail:

{
    "eventVersion": "1.08",
    "userIdentity": {
        "type": "AssumedRole",
        "principalId": "XXXXXXXXXXXXXXXXXXXXX:LambdaDescribeHandlerSession",
-- snip ---
        "invokedBy": "config.amazonaws.com"
    },
    "eventTime": "2021-10-30T02:19:55Z",
    "eventSource": "kms.amazonaws.com",
    "eventName": "Decrypt",
    "awsRegion": "ap-northeast-1",
    "sourceIPAddress": "config.amazonaws.com",
    "userAgent": "config.amazonaws.com",
    "errorCode": "AccessDenied",
    "errorMessage": "User: arn:aws:sts::000000000000:assumed-role/aws-controltower-ConfigRecorderRole/LambdaDescribeHandlerSession is not authorized to perform: kms:Decrypt on resource: arn:aws:kms:ap-northeast-1:000000000000:key/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx because no resource-based policy allows the kms:Decrypt action",
-- snip --
}