(eks): Support isolated VPCs

Provisioning clusters inside an isolated vpc (i.e no internet access) is not currently supported.
This is because the lambda functions that operate the cluster need to invoke the EKS service, which does not offer a VPC endpoint.

> See https://github.com/aws/containers-roadmap/issues/298

### Use Case

We've seen users mentioning their environment uses an isolated VPC.

### Other

Adding some information here to possibly facilitate alternative approaches.

If you have a proxy setup, you can inject proxy information to the handlers via custom environment variables.

```ts
const proxy = "https://proxy.mycompany.com:8080/”;
new eks.Cluster(this, 'Cluster', {
...,

kubectlEnvironment: {
HTTPS_PROXY: proxy,
},

clusterHandlerEnvironment: {
HTTPS_PROXY: proxy
}
})
```

Also, following is a list of AWS services that our Lambda handlers interact with in order to operate the cluster. All of these services offer a VPC endpoint **except** for EKS.

- Lambda
- Step Functions
- CloudFormation
- STS
- S3
- EKS

Related: https://github.com/aws/aws-cdk/issues/10036

Once EKS does offer a VPC endpoint, it would be nice if we just provision the necessary endpoints given if we identify that the VPC does not have internet access (internet gateway, NAT).

* [ ] :wave: I may be able to implement this feature request
* [ ] :warning: This feature might incur a breaking change

---

This is a :rocket: Feature Request

The issue names no files or tests. Start by tracing the EKS cluster’s Lambda handlers and their interactions with Lambda, Step Functions, CloudFormation, STS, S3, and EKS, then review the linked AWS EKS VPC-endpoint roadmap issue. Done would mean defining and validating a supported approach for operating clusters in isolated VPCs.

Written by the indexing model from the issue text.