EKS: Default Control Plane Security Group Doesn't Create Ingress Rules

### Describe the bug

By default, an EKS `Cluster` does not create ingress rules for the security group applied to the control plane. This seems unintuitive as allowing inbound 443 from worker nodes feels like a sane default requirement for anything to work.

### Expected Behavior

An ingress rule allowing 443 inbound from the VPC or worker node security group or some warning emitted that the security group has not been configured with inbound access.

### Current Behavior

No ingress rule or warning emitted.

### Reproduction Steps

Just create an EKS cluster.

### Possible Solution

Automatically add an ingress rule or emit a warning during synth if the user has not created ingress.

### Additional Information/Context

_No response_

### CDK CLI Version

2.138.0

### Framework Version

_No response_

### Node.js Version

v20.9.0

### OS

darwin

### Language

.NET

### Language Version

_No response_

### Other information

_No response_

Start with the EKS Cluster construct and synth the minimal reproduction described in the issue to inspect the generated control-plane security group. Compare the generated ingress behavior with the expected worker-node or VPC access, then determine whether the accepted outcome is an ingress rule or a synth warning. Done means the chosen behavior is implemented and covered by a regression test.

Written by the indexing model from the issue text.