(aws-eks): KubernetesManifest to support `--prune-whitelist` flag

### Describe the feature

(Basically re-opening https://github.com/aws/aws-cdk/issues/13658)

Allow users to provide a list of resources as the scope of pruning when creating `KubernetesManifest` construct

### Use Case

1, We deploy custom resource such as `elbv2.k8s.aws/v1beta1/TargetGroupBinding` via CDK8s generated manifest, but these custom resource are not pruned by default without explicitly specifying the `--prune-whitelist` flag.

(following copied from https://github.com/aws/aws-cdk/issues/13658)

1, Something we only want to prune certain resources. For example, in [this discussion](https://github.com/kubernetes/kubernetes/issues/66430#issuecomment-497314645), they can use `--prune-whitelist` to avoid namespace got pruned. It makes `--prune` safer and more useful in practice.

2, The role runs `kubectl` may not have `list` permission on global `pv` or `daemonset`, and enabling `--prune` will throw a permission error, even though there are no resources to prune.

### Proposed Solution

Add `pruneWhitelist` to `KubernetesManifest` as an array of string which allows users to provide a list of resources to prune on.

### Other Information

_No response_

### Acknowledgements

- [ ] I may be able to implement this feature request
- [ ] This feature might incur a breaking change

### CDK version used

2.28.1

### Environment details (OS name and version, etc.)

Mac and AL2

Start by locating the TypeScript KubernetesManifest construct and its existing kubectl prune handling. Trace how prune options are passed to kubectl, then add coverage for a string-array whitelist and verify pruning can be scoped to the requested resources.

Written by the indexing model from the issue text.