(eks): EKS ALB Controller cannot provision ALB with OIDC configuration

### Describe the bug

AlbController cannot provision ALB with OIDC configuration: `User "system:serviceaccount:kube-system:aws-load-balancer-controller" cannot get resource "secrets" in API group`.

### Regression Issue

- [ ] Select this option if this issue appears to be a regression.

### Last Known Working CDK Version

_No response_

### Expected Behavior

ALB Controller can be used to provision ALB's

### Current Behavior

```json
"log": "{\"level\":\"error\",\"ts\":\"2025-01-29T08:26:18Z\",\"msg\":\"Reconciler error\",\"controller\":\"ingress\",\"object\":{\"name\":\"app-name.domain-name-ingress\",\"namespace\":\"namespace-name\"},\"namespace\":\"namespace-name\",\"name\":\"app-name.domain-name-ingress\",\"reconcileID\":\"cba15a83-4c7c-4c6a-8827-010514fc27da\",\"error\":\"ingress: namespace-name/app-name.domain-name-ingress: secrets \\\"golinks-okta-secret\\\" is forbidden: User \\\"system:serviceaccount:kube-system:aws-load-balancer-controller\\\" cannot get resource \\\"secrets\\\" in API group \\\"\\\" in the namespace \\\"namespace-name\\\"\"}",
```

### Reproduction Steps

```yaml
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: app-ingress
annotations:
kubernetes.io/ingress.class: alb
alb.ingress.kubernetes.io/scheme: internet-facing
alb.ingress.kubernetes.io/auth-type: oidc
alb.ingress.kubernetes.io/auth-idp-oidc: '{"issuer":"https://sso.supercell.com","authorizationEndpoint":"https://okta/oauth2/v1/authorize","tokenEndpoint":"https://okta/oauth2/v1/token","userInfoEndpoint":"https://okta/oauth2/v1/userinfo","secretName":"app-name-okta-secret"}'

```

### Possible Solution

Please add the required permissions for it to work :) Is there any workaround for this?

### Additional Information/Context

_No response_

### CDK CLI Version

2.177.0 (build b396961)

### Framework Version

_No response_

### Node.js Version

v22.13.0

### OS

Mac

### Language

TypeScript

### Language Version

_No response_

### Other information

_No response_

Start by reproducing the EKS ALB Controller OIDC configuration with the provided Ingress manifest and trace the CDK-generated permissions for the controller service account. Confirm which required secret access is missing and verify that an OIDC ALB provisions without the Kubernetes forbidden-secret error.

Written by the indexing model from the issue text.