[EKS] [request]: Permit "client auth" key for EKS CertificateSigningRequest

### Community Note

* Please vote on this issue by adding a 👍 [reaction](https://blog.github.com/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/) to the original issue to help the community and maintainers prioritize this request
* Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
* If you are interested in working on this issue or have submitted a pull request, please leave a comment

**Tell us about your request**
What do you want us to build?

- When a CertificateSigningRequest is created on Amazon EKS Cluster, EKS Permits key usages: ["key encipherment", "digital signature", "server auth"]
- https://docs.aws.amazon.com/eks/latest/userguide/cert-signing.html

```
Permitted key usages: Must not include usages beyond ["key encipherment", "digital signature", "server auth"]
```

**Which service(s) is this request for?**
This could be EKS

**Tell us about the problem you're trying to solve. What are you trying to do, and why is it hard?**
What outcome are you trying to achieve, ultimately, and why is it hard/impossible to do right now? What is the impact of not having this problem solved? The more details you can provide, the better we'll be able to understand and solve the problem.

**Are you currently working around this issue?**
How are you currently solving this problem?
n/a

**Additional context**
Anything else we should know?

- Create a CSR request using below steps and validate CSR is approved but no certificate issued.

```
openssl genrsa -out myserver.key 2048
openssl req -new -key myserver.key -out myserver.csr -subj "/CN=myserver.default.svc"
cat myserver.csr | base64 -w 0 | tr -d "\n"

#Create file csr.yml and replace "base64-value" placeholder below with base64 value from previous command
apiVersion: certificates.k8s.io/v1
kind: CertificateSigningRequest
metadata:
name: myserver
spec:
request: base64-value
signerName: beta.eks.amazonaws.com/app-serving
usages:
- client auth

kubectl apply -f mycsr.yaml
kubectl certificate approve myserver

kubectl get csr myserver

kubectl get csr myserver -o jsonpath='{.status.certificate}'| base64 -d > myserver.crt
```

- Validate `myserver.crt` is empty file with no certificate
- `signerName` can be `beta.eks.amazonaws.com/app-serving` or `kubernetes.io/kube-apiserver-client` and still no certificate

**Attachments**
If you think you might have additional information that you'd like to include via an attachment, please do - we'll take a look. (Remember to remove any personally-identifiable information.)

Reproduce the request using the listed openssl commands and the mycsr.yaml CertificateSigningRequest, then inspect the resulting CSR and certificate status with kubectl. The change is complete when a CSR using the client auth usage is approved and myserver.crt contains the issued certificate for the documented signer names.

Written by the indexing model from the issue text.