eks: default node group role should use AmazonEC2ContainerRegistryPullOnly managed policy

### Describe the bug

Where it's convenient, the EKS constructs generate a default role for EKS nodes. To allow the nodes to pull from ECR the CDK attaches the `AmazonEC2ContainerRegistryReadOnly` managed policy to the role.

For example, in the constructor of the `Nodegroup` class:

https://github.com/aws/aws-cdk/blob/e6de9471d2eaae26b8179e45c7791e684e4825fd/packages/aws-cdk-lib/aws-eks/lib/managed-nodegroup.ts#L504

and also in the function `connectAutoScalingGroupCapacity`:

https://github.com/aws/aws-cdk/blob/e6de9471d2eaae26b8179e45c7791e684e4825fd/packages/aws-cdk-lib/aws-eks/lib/cluster.ts#L1302

As described in #35244 this managed policy provides read-only access to many ECR endpoints which is probably not required. At the same time, it doesn't include the `ecr:BatchImportUpstreamImage` action, which is required to use a pull-through cache.

Reference:
* https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonEC2ContainerRegistryPullOnly.html
* https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonEC2ContainerRegistryReadOnly.html
* #35244

### Regression Issue

- [ ] Select this option if this issue appears to be a regression.

### Last Known Working CDK Library Version

_No response_

### Expected Behavior

The default node groups should use a role with minimal permissions that allow the use of a pull through cache.

### Current Behavior

The generated node role uses the `AmazonEC2ContainerRegistryReadyOnly` managed policy which provides unneccessarily broad access to the ECR API, but doesn't allow the use of a pull-through cache.

### Reproduction Steps

Create an EKS cluster with the default parameters.

### Possible Solution

I suggest to replace the `AmazonEC2ContainerRegistryReadyOnly` managed policy with `AmazonEC2ContainerRegistryPullOnly` in the EKS library's code where a default node role is generated.

### Additional Information/Context

In the context of the KubectlProvider, the same issue was fixed last year. See #35244

### AWS CDK Library version (aws-cdk-lib)

main branch

### AWS CDK CLI version

main branch

### Node.js Version

n/a

### OS

n/a

### Language

TypeScript

### Language Version

_No response_

### Other information

_No response_

Start in packages/aws-cdk-lib/aws-eks/lib/managed-nodegroup.ts at the Nodegroup constructor and in packages/aws-cdk-lib/aws-eks/lib/cluster.ts at connectAutoScalingGroupCapacity. Compare the referenced managed-policy usage with the AWS PullOnly policy documentation and the KubectlProvider change in #35244. Done means both default node-role paths use AmazonEC2ContainerRegistryPullOnly.

Written by the indexing model from the issue text.