[EKS] [request]: Provide proper PodSecurityPolicy's for AWS provided cluster components

### Community Note

* Please vote on this issue by adding a 👍 [reaction](https://blog.github.com/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/) to the original issue to help the community and maintainers prioritize this request
* Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
* If you are interested in working on this issue or have submitted a pull request, please leave a comment

**Tell us about your request**
Currently, EKS ships with a very permissive `eks.restricted` `PodSecurityPolicy`. All authenticated users can create pods that use this security policy.

In the interests of maintaining good security posture, it would be preferable to have least-privileged PSPs that accompany AWS provided EKS components. This would include at minimum, the components that are installed on EKS out-of-the-box, i.e.:
* The AWS CNI daemonset
* Kube proxy
* CoreDNS

The AWS CNI daemonset would be the real work here, because the other two are open source and easy to find PSPs for.

At this point, EKS could ship without the `eks.privileged` PodSecurityPolicy. Alternatively, you could leave a PSP called `privileged` with the same privileges, and document how to give privileged pods permission to use that PSP. This would result in a better security posture by default in EKS clusters.

Furthermore, it would be great to have a PSP for the [Amazon Cloudwatch agent for EKS](https://github.com/aws-samples/amazon-cloudwatch-container-insights). This is what prompted this request, because crafting a PSP for this component has proven difficult.

**Which service(s) is this request for?**
EKS

**Tell us about the problem you're trying to solve. What are you trying to do, and why is it hard?**
We're attempting to craft a better security posture in our Kubernetes clusters, with least-privileged access for all components. Having a default `eks.privileged` PSP is insecure, so we are trying to have an individual PSP for each component that needs elevated access, as per this great blog article: https://developer.squareup.com/blog/kubernetes-pod-security-policies/.

**Are you currently working around this issue?**
Trial and error to get a PSP that works for a particular component. The Cloudwatch agent has proven difficult, because even after providing access to the `hostPath`s that are mounted by the container, the agent seems to be trying to access other files on disk, which it can't do.