[EKS] [OIDC]: Support idp with self signed certificate

### Community Note

* Please vote on this issue by adding a 👍 [reaction](https://blog.github.com/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/) to the original issue to help the community and maintainers prioritize this request
* Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
* If you are interested in working on this issue or have submitted a pull request, please leave a comment

**Tell us about your request**

The new OIDC for EKS requires a commercially signed certificate on the IdP. There's no way to specify a certificate for the authority. Many enterprises have an internal CA that they use for web applications. A self hosted identity provider in an enterprise is likely to have a self-signed CA.

**Which service(s) is this request for?**
EKS

**Tell us about the problem you're trying to solve. What are you trying to do, and why is it hard?**

Use EKS OIDC with a self-hosted idp using an internal CA.

**Are you currently working around this issue?**
Using impersonation with a reverse proxy in front of the API server

**Additional context**
Anything else we should know?

**Attachments**
If you think you might have additional information that you'd like to include via an attachment, please do - we'll take a look. (Remember to remove any personally-identifiable information.)

Start by reviewing the EKS OIDC integration and how certificate trust is configured for the identity provider. Compare that with the reverse-proxy impersonation workaround described in the issue; done means EKS OIDC can use an identity provider backed by an internal or self-signed CA.

Written by the indexing model from the issue text.