Currently, ROSA HCP clusters with y-stream versions 4.14 and 4.15 pull their AWS KMS image from the CI registry.

https://github.com/openshift/hypershift/blob/release-4.15/control-plane-operator/main.go#L150

This should not be.

In 4.16 and later, this image is pulled from the payload, so this is not an issue.

We should
1) have CI promote and maintain registry.ci.openshift.org/hypershift/aws-encryption-provider:latest (until 4.15 EOL on ROSA)
2) have CI mirror this image to quay.io
3) change 4.15.z/4.14.z to use the quay.io image and reference in by sha (not latest)