[EKS] [request]: Internet-facing LB with network firewall

### Community Note

* Please vote on this issue by adding a 👍 [reaction](https://blog.github.com/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/) to the original issue to help the community and maintainers prioritize this request
* Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
* If you are interested in working on this issue or have submitted a pull request, please leave a comment

**Tell us about your request**
To create internet-facing LB with network firewall

**Which service(s) is this request for?**
EKS

**Tell us about the problem you're trying to solve. What are you trying to do, and why is it hard?**
I would like to create an internet-facing LB in public subnets and deploy an network firewall between the LB in the public subnets and an IGW. In this case, the public subnets should have a route table that routes 0.0.0.0/0 to an vpc endpoint(GWLB) of the network firewall instead of the IGW.
When I tried to create an internet-facing LB in the public subnets with the following manifest, it was failed.
```
apiVersion: apps/v1
kind: Deployment
metadata:
name: eks-test
spec:
replicas: 3
selector:
matchLabels:
app: nginx
template:
metadata:
labels:
app: nginx
spec:
containers:
- name: nginx
image: public.ecr.aws/z9d2n7e1/nginx:1.19.5
ports:
- name: http
containerPort: 80
---
apiVersion: v1
kind: Service
metadata:
name: eks-test
annotations:
service.beta.kubernetes.io/aws-load-balancer-type: nlb
spec:
ports:
- port: 80
targetPort: 80
protocol: TCP
type: LoadBalancer
selector:
app: nginx
```

```
$ kubectl describe svc eks-test
Name: eks-test
Namespace: default
Labels:
Annotations: service.beta.kubernetes.io/aws-load-balancer-type: nlb
Selector: app=nginx
Type: LoadBalancer
IP: 172.20.123.82
Port: 80/TCP
TargetPort: 80/TCP
NodePort: 31115/TCP
Endpoints: 10.0.4.150:80,10.0.4.48:80,10.0.5.58:80
Session Affinity: None
External Traffic Policy: Cluster
Events:
Type Reason Age From Message
---- ------ ---- ---- -------
Normal EnsuringLoadBalancer 5s (x4 over 41s) service-controller Ensuring load balancer
Warning SyncLoadBalancerFailed 5s (x4 over 41s) service-controller Error syncing load balancer: failed to ensure load balancer: could not find any suitable subnets for creating the ELB
```

It seems that only when subnets have an IGW, in-tree Kubernetes load balancer controller considers that those are public subnets. To use an network firewall between LB and IGW, this issue should be fixed.

**Are you currently working around this issue?**
Use IP targets instead of instance targets
```
service.beta.kubernetes.io/aws-load-balancer-type: nlb-ip
```

**Additional context**
https://aws.amazon.com/ko/blogs/networking-and-content-delivery/deployment-models-for-aws-network-firewall/?fbclid=IwAR2ZrDg980UFX4pnERuJVGqkolfxzVvLxpNWuuLVrkTNHxKnHzyWalZjRZY

**Attachments**
If you think you might have additional information that you'd like to include via an attachment, please do - we'll take a look. (Remember to remove any personally-identifiable information.)

Start by reproducing the provided EKS Deployment and LoadBalancer Service manifest in a cluster whose public subnets route through a Gateway Load Balancer endpoint. Inspect the in-tree Kubernetes load balancer controller's subnet-selection path and compare instance targets with the documented nlb-ip workaround. Done means an internet-facing instance-target NLB can use those subnets while preserving the network firewall route.

Written by the indexing model from the issue text.