[aws-eks] Restricting access to Amazon EC2 instance profile credentials and use IRSA in VPC CNI plugin

After 'IAM Roles for service accounts' was introduced in EKS there is a official way to restrict access to EC2 instance profile ( https://docs.aws.amazon.com/eks/latest/userguide/restrict-ec2-credential-access.html ) and use IRSA in VPC plugin ( https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts-cni-walkthrough.html ) instead of adding AWS managed policy AmazonEKS_CNI_Policy to every role used by EC2 worker nodes.

The problem is that CDK doesn't support it and there is a need to implement some hacks:

1. Service account for aws-node can be updated by just creating new service account from CDK which updates the one created by EKS by adding annotation with IAM role.
2. User data for every EC2 has to be updated by manually modifying launch configuration for ASG generated by CDK.
3. Managed policy AmazonEKS_CNI_Policy has to be removed from EC2 by manually modifying CfnRole.managed_policy_arns because CDK adds it always by default:
https://github.com/aws/aws-cdk/blob/e51921d1a81ba9d89e21567291b5f7b215726ca7/packages/%40aws-cdk/aws-eks/lib/cluster.ts#L1165

Please consider adding native support for it in CDK.

---

This is a :rocket: Feature Request

Start in packages/@aws-cdk/aws-eks/lib/cluster.ts around the AmazonEKS_CNI_Policy handling, then review the linked EKS documentation for credential restriction and IRSA. Define native support covering the aws-node service-account annotation, EC2 user data, and removal of the node role policy; done means these hacks are no longer required.

Written by the indexing model from the issue text.