aws-eks: cdk should validate cluster version and kubectl layer version

### Describe the bug

Ever since we upgraded from Kubernetes 1.21 to newer versions, we're getting lots of weird errors related to what I believe are kubectl layer incompatibilities, like

```
3:40:15 PM | UPDATE_FAILED | Custom::AWSCDK-EKS-KubernetesResource | clusterAwsAuthmanifestB57F2A94
Received response status [FAILED] from custom resource. Message returned: Error: b'configmap/aws-auth configured\nerror: error retrieving RESTMappings to prune: invalid resource extensions/v1bet
a1, Kind=Ingress, Namespaced=true: no matches for kind "Ingress" in version "extensions/v1beta1"\n'
```

It would be much better if cdk actually validated the layer version vs the intended kubernetes version when synthesising, so that these issues didn't occur

### Expected Behavior

cdk should error out, informing me that the selected cluster version doesn't match the configured layer

### Current Behavior

No validation occurs, which leads to lots of errors when trying to change the cluster later

### Reproduction Steps

- create cluster version 1.23
- make a change, such as add a node group
- witness the layer error described above

### Possible Solution

_No response_

### Additional Information/Context

_No response_

### CDK CLI Version

2.67.0

### Framework Version

2.66.1

### Node.js Version

v18.14.2

### OS

Ubuntu

### Language

Python

### Language Version

3.9

### Other information

_No response_

Start by tracing AWS CDK EKS cluster synthesis for the configured Kubernetes version and kubectl layer version, then inspect the existing validation path. Reproduce the version 1.23 mismatch and verify that synthesis reports a clear error for incompatible versions while compatible configurations continue successfully.

Written by the indexing model from the issue text.