[aws-eks] Helm registry login

Currently, there is no way of accessing a private helm registry. By adding support for the helm registry login command, we can consume private charts in the same way as on a local cluster.

### Use Case

In order to consume and deploy a private helm chart into my EKS cluster.

### Proposed Solution
I would propose specifying a secret or secret resolve string in the _HelmChartOptions_
This is then passed to the [kubectl handler Lambda function](https://github.com/aws/aws-cdk/blob/master/packages/@aws-cdk/aws-eks/lib/kubectl-handler/helm/__init__.py)

Prior to calling [upgrade](https://github.com/aws/aws-cdk/blob/master/packages/@aws-cdk/aws-eks/lib/kubectl-handler/helm/__init__.py#L50) I would check if a secret is passed.
This needs to be resolved using the secrets manager and the actual login data is passed to the `helm registry login` command

* [x] :wave: I may be able to implement this feature request
* [ ] :warning: This feature might incur a breaking change

---

This is a :rocket: Feature Request

Start with HelmChartOptions and the kubectl handler Lambda at packages/@aws-cdk/aws-eks/lib/kubectl-handler/helm/__init__.py, especially the upgrade call. Trace how a secret or secret resolve string could reach that handler and how Helm registry login should use it. Done means private Helm charts can be consumed and deployed to an EKS cluster.

Written by the indexing model from the issue text.