[EKS] [request]: Kubernetes Restricted Label support for Managed Node Groups

### Community Note

* Please vote on this issue by adding a 👍 [reaction](https://blog.github.com/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/) to the original issue to help the community and maintainers prioritize this request
* Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
* If you are interested in working on this issue or have submitted a pull request, please leave a comment

**Tell us about your request**

The Managed Node Groups API current rejects labels with prefixes containing `kubernetes.io/`, `k8s.io/`, `eks.amazonaws.com/`. I haven't checked, but I assume this is actually matching the behaviour of the [NodeRestriction Admission Controller](https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#noderestriction) with the addition of `eks.amazonaws.com/` as a further restricted domain, as motivated by the [Bounding Self-Labeling Kubelets KEP](https://github.com/kubernetes/enhancements/tree/master/keps/sig-auth/279-limit-node-access).

This restriction is not mentioned in the [Cloud Formation Managed Node Group API documentation](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-eks-nodegroup.html#cfn-eks-nodegroup-labels).

**Which service(s) is this request for?**
EKS Managed Node Groups

**Tell us about the problem you're trying to solve. What are you trying to do, and why is it hard?**

Although this problem has been known for a while with, e.g., eksctl and unmanaged node groups (see https://github.com/weaveworks/eksctl/issues/2363), the only current solution on the table for that is https://github.com/kubernetes/cloud-provider-aws/issues/110 which hasn't advanced in a while, sadly.

Managed Node Groups may want to implement the feature differently, or formalise/document the restrictions as "working as designed", or explicitly decide to build a solution on top of https://github.com/kubernetes/cloud-provider-aws/issues/110 (or another solution) once it exists.

eksctl has a different bug tracking this use-case for Managed Node Groups, https://github.com/weaveworks/eksctl/issues/4007, and I only just noticed that there was no corresponding feature-request here for restricted-label support in Managed Node Groups.

**Are you currently working around this issue?**

Not using the restricted labels, e.g., if you don't populate `node-role.kubernetes.io/`, you don't see a role listed in the `kubectl get` output's dedicated column for this value.

**Additional context**

This is different from #854 and #733, which was a request to _implicitly_ apply the Managed Node Group's name as the `node-role.kubernetes.io/`-prefixed label. This feature request is for general support of otherwise-restricted label prefixes (including but not limited to `node-role.kubernetes.io`) in the `Labels` field of the Managed Node Group API.

**Attachments**

None.

Start with the EKS Managed Node Groups Labels API and linked CloudFormation documentation, then review the NodeRestriction KEP and related issues #854, #733, eksctl #4007, and cloud-provider-aws #110. Done is a decided implementation or documented behavior for restricted label prefixes, with the relevant API or documentation outcome recorded.

Written by the indexing model from the issue text.