Add EKS Capabilities CloudWatch Vended Logs configuration for ArgoCD, ACK, and kro

## Summary

[Amazon EKS Capabilities now supports Amazon CloudWatch Vended Logs](https://aws.amazon.com/about-aws/whats-new/2026/06/amazon-eks-capabilities-logging/) (announced June 4, 2026). This enables customers to monitor and troubleshoot EKS Capabilities controllers (ArgoCD, ACK, kro) by collecting logs from the AWS-managed infrastructure.

## What needs to be done

Add log delivery configuration as part of the existing EKS Capability setup (Terraform module, Crossplane composition, or kro RGD) — not as a separate addon. When a capability is created, log delivery should be configurable as an optional parameter of that capability resource.

### Where to integrate

Depending on how the capability is provisioned in the blueprint:
- **Terraform** — add CloudWatch delivery resources in the same module that creates the capability
- **Crossplane composition** — include the log delivery resources in the capability composition
- **kro RGD** — add log delivery as part of the ResourceGraphDefinition that provisions the capability

### Supported Log Types

**ArgoCD** (5 independent log types):
- `EKS_CAPABILITY_ARGOCD_APPLICATION_LOGS`
- `EKS_CAPABILITY_ARGOCD_APPLICATIONSET_LOGS`
- `EKS_CAPABILITY_ARGOCD_COMMITSERVER_LOGS`
- `EKS_CAPABILITY_ARGOCD_REPOSERVER_LOGS`
- `EKS_CAPABILITY_ARGOCD_SERVER_LOGS`

**ACK**:
- `EKS_CAPABILITY_ACK_LOGS` (single type covering all ACK service controllers, with `controllerGroup` field for filtering)

**kro**:
- `EKS_CAPABILITY_KRO_LOGS`

### Implementation details

Use CloudWatch APIs to configure log delivery alongside capability creation:

1. **`PutDeliverySource`** — use the capability ARN as `resourceArn` and specify the log type
2. **`PutDeliveryDestination`** — specify the ARN of a CloudWatch log group, S3 bucket, or Firehose delivery stream
3. **`CreateDelivery`** — connect source to destination

The capability ARN can be retrieved via:
```bash
aws eks describe-capability \
--cluster-name \
--capability-name \
--query 'capability.capabilityArn' --output text
```

### Suggested interface (per capability module)

```hcl
# Example: Terraform variable on the ArgoCD capability module
variable "enable_logging" {
type = bool
default = true
}

variable "log_destination_type" {
type = string
default = "cloudwatch" # "cloudwatch" | "s3" | "firehose"
}

variable "log_types" {
type = list(string)
default = ["all"] # or specific log types
}
```

### Destination options
- **CloudWatch Logs** — query with Logs Insights
- **Amazon S3** — analyze with Athena
- **Amazon Data Firehose** — stream to OpenSearch, Redshift, etc.

### Pricing
Standard CloudWatch Vended Logs pricing applies. No additional EKS charge.

## Documentation references
- [What's New announcement](https://aws.amazon.com/about-aws/whats-new/2026/06/amazon-eks-capabilities-logging/)
- [EKS Capabilities controller logs docs](https://docs.aws.amazon.com/eks/latest/userguide/capabilities-controller-logs.html)
- [CloudWatch Vended Logs permissions](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/AWS-vended-logs-permissions-V2.html)

## Context

This complements the existing `enable_argocd_health_checks` addon (PR #742) by adding observability for the managed controllers. With health checks providing application-level visibility and logs providing controller-level visibility, customers get full observability of their EKS Capabilities deployment.

Inspect the existing EKS Capability setup, including its Terraform module, Crossplane composition, or kro ResourceGraphDefinition, and review PR #742 for the related health-check integration. Start by checking how the capability ARN is obtained with aws eks describe-capability, then compare the CloudWatch PutDeliverySource, PutDeliveryDestination, and CreateDelivery flow with the referenced EKS logging documentation. Done means logging is an optional capability parameter and supports the listed ArgoCD, ACK, and kro log types.

Written by the indexing model from the issue text.