[EKS] [request]: Custom Service Linked Role for EKS Managed Node Group

### Community Note

* Please vote on this issue by adding a 👍 [reaction](https://blog.github.com/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/) to the original issue to help the community and maintainers prioritize this request
* Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
* If you are interested in working on this issue or have submitted a pull request, please leave a comment

**Tell us about your request**
Capability to specify a custom service linked role for EKS managed node groups.

**Which service(s) is this request for?**
EKS

**Tell us about the problem you're trying to solve. What are you trying to do, and why is it hard?**
At my organization, we have a team that is responsible for creating AMIs that follow our required baseline security standards. These AMIs are encrypted with a customer managed KMS key which a key policy that allows it to be used by anyone in our AWS organization to decrypt said AMIs. In the downstream accounts, users and services must be granted requisite permissions to perform decrypt actions with this KMS key. For example, when we want an Auto Scaling Group to directly consume the AMIs, we [create](https://docs.aws.amazon.com/autoscaling/ec2/userguide/autoscaling-service-linked-role.html#create-service-linked-role-manual) a custom Service Linked Role for the AWS ASG Service, create a KMS grant to allow that role to decrypt with the aformentioned KMS key, and then [attach](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-as-group.html#cfn-autoscaling-autoscalinggroup-servicelinkedrolearn) that role to an ASG when we create it.

When you create a managed node group, not only does there not appear to be a way to provide a custom service linked role for the Node Group itself, it also appears impossible to provide a custom service linked role that the the node group should pass to the autoscaling group it creates.

**Are you currently working around this issue?**

We are currently working around this problem by copying the AMI to a local account, encrypting it with a KMS key local to that AWS account. We could use a grant on the off-the-shelf Amazon provided service linked role; however, this seems fraught as we don't have a way of consistently and directly affecting that service linked role itself.

**Additional context**

Some issues I found that are related to this:

- #1087
- #122

No repository files or tests are named. Start by reviewing the EKS managed node group and service-linked-role behavior described in the issue, then read related issues #1087 and #122; done means supporting custom service-linked roles for the node group and the Auto Scaling Group it creates.

Written by the indexing model from the issue text.