Agent fails with credential errors, cannot use IAM Roles for Service Accounts (IRSA) or EKS Pod Identities with EKS Addon

Users may wish to run the CloudWatch Agent using pod-based IAM roles, using the IRSA or EKS Pod Identities technologies. Recently (PR below) this was enabled when an environment variable is set on the agent pod, `RUN_WITH_IRSA=true`, and this enables the agent to utilize the default provider chain for AWS authentication.

However, the EKS Addon for AWS CloudWatch Observability creates a managed `AmazonCloudWatchAgent` configuration, making it unsafe - there is no guarantee it won't be overridden - to add environment variables.

## Background

CloudWatch Agent PR:
- https://github.com/aws/amazon-cloudwatch-agent/pull/682/files

# Expected behavior

Running the EKS Addon for AWS CloudWatch Observability with pod-based IAM should work by default.

# Actual behavior

The agent fails, and there is no knob available to users to ensure the agent works.

# Proposal

Either of these solutions would address this:
* The Addon and Operator should permit an additional configuration, to merge either individual env vars or arbitrary config into the `AmazonCloudWatchAgent` custom resource
* The Agent's configuration file, `cwagentconfig.json`, which is managed by the add-on should accept a configuration key to enable the RUN_WITH_IRSA mode.

Read the linked CloudWatch Agent PR 682, then trace how the EKS Addon-managed AmazonCloudWatchAgent configuration produces cwagentconfig.json. Compare the proposed environment-variable merge with a configuration-key approach, and verify that pod-based IAM works by default without manually adding RUN_WITH_IRSA=true.

Written by the indexing model from the issue text.