eks: support for blocking node-level instance metadata

### Describe the feature

According to https://aws.github.io/aws-eks-best-practices/security/docs/iam/#restrict-access-to-the-instance-profile-assigned-to-the-worker-node, its _strongly_ recommended to disallow pods accessing the node's instance metadata.

Since this is a strong recommendation, it's troubling that cdk-eks doesn't support this for managed node groups. The only way I can see it possible to do this today, is by specifying a full node template, which kindof defeats the purpose of manage node groups.

### Use Case

To follow AWS' best practices

### Proposed Solution

Allow supplying an optional "metadata options" object to the node group.

### Other Information

_No response_

### Acknowledgements

- [ ] I may be able to implement this feature request
- [ ] This feature might incur a breaking change

### CDK version used

2.151.0

### Environment details (OS name and version, etc.)

Ubuntu 24

No files or tests are named in the issue. Start by locating the EKS managed node group construct and reviewing the AWS guidance linked in the request; done means an optional metadata options object can configure blocking node-level instance metadata for managed node groups, with coverage for the resulting behavior.

Written by the indexing model from the issue text.