eks: Windows Node Groups get an aws-auth roleMapping without eks:kube-proxy-windows

### Describe the bug

Per the [AWS documentation](https://docs.aws.amazon.com/eks/latest/userguide/windows-support.html#enable-windows-support:~:text=eks%3Akube%2Dproxy%2Dwindows%20%23%20This%20group%20is%20required), the `eks:kube-proxy-windows` group is required for kube-proxy to work for windows nodes.

In the [current state](https://github.com/aws/aws-cdk/blob/fb17d39054d9a41345a5b4c83c44b32a838e3c86/packages/aws-cdk-lib/aws-eks/lib/managed-nodegroup.ts#L581), the nodes all get created with groups that exclude that one. This forces users to use a workaround like call cluster.awsAuth.addRoleMapping manually, which risks adding duplicate values to the aws-auth ConfigMap.

### Regression Issue

- [ ] Select this option if this issue appears to be a regression.

### Last Known Working CDK Library Version

_No response_

### Expected Behavior

When creating a NodeGroup where the AmiType is Windows (e.g. `props.amiType && windowsAmiTypes.includes(props.amiType)`), the `eks:kube-proxy-windows` group should be added, or we should at least be able to provide a custom list of roles for the NodeGroup.

### Current Behavior

The `eks:kube-proxy-windows` group is not added for Windows node groups, and we are unable to provide a custom list of groups.

### Reproduction Steps

1. Instantiate a `Nodegroup` object with a Windows AMI
2. Deploy and confirm that the created `aws-auth` ConfigMap does not contain the expected `eks:kube-proxy-windows` group

### Possible Solution

Conditionally add the `eks:kube-proxy-windows` group when the AmiType is part of windowsAmiTypes (`props.amiType && windowsAmiTypes.includes(props.amiType)`). Alternatively, allow providing a custom list of groups for the node role, defaulting to the existing values.

### Additional Information/Context

_No response_

### AWS CDK Library version (aws-cdk-lib)

aws-cdk-lib@2.189.1

### AWS CDK CLI version

2.1004.0 (build f0ad96e)

### Node.js Version

v20.17.0

### OS

macOS 15.7.2 (24G325)

### Language

TypeScript

### Language Version

typescript@5.1.6

### Other information

_No response_

Start in packages/aws-cdk-lib/aws-eks/lib/managed-nodegroup.ts around the linked roleMapping code and inspect how Windows AMI types are identified. Create or deploy a Windows NodeGroup as described in the reproduction steps, then verify that aws-auth includes eks:kube-proxy-windows without duplicate mappings; the issue also mentions custom groups as an alternative to evaluate.

Written by the indexing model from the issue text.