[EKS] [request]: Native, granular ECR permissions

### Community Note

* Please vote on this issue by adding a 👍 [reaction](https://blog.github.com/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/) to the original issue to help the community and maintainers prioritize this request
* Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
* If you are interested in working on this issue or have submitted a pull request, please leave a comment

**Tell us about your request**
Would be great to have a more granular permission mechansim to enforce ECR pull access on a Pod or Namespace level instead of EC2 level.

For example, there could be an additional IRSA-like annotation on a ServiceAccount to specify the IAM Role that should be used for the image pull and then maybe some controller could continously impersonate that role renew an imagePullSecret for that SA.

**Which service(s) is this request for?**
EKS / ECR

**Tell us about the problem you're trying to solve. What are you trying to do, and why is it hard?**
Currently, EKS -> ECR permissions are scoped to nodes. This means that as long as someone has access to create a Pod on a given node, they can run _any_ image the node's allowed to pull, even if that image is owned by another team.

This is generally not a problem with static credentials and external registries: As long as the host supports scoping users/keys, granular keys can be provisioned and used in image pull secrets. However, this is not an option for ECR, as static credentials are short-lived.

**Are you currently working around this issue?**
Potential workarounds are:
- Design node groups around ECR permission boundaries (e.g. team/namespace)
- Use K8S API admission (Kyverno, Gatekeeper, etc) on create Pod requests to reject/allow images more granularly

Start by reviewing how EKS currently obtains ECR image-pull permissions at the node level, then compare the request with IRSA, ServiceAccount annotations, and imagePullSecrets. The work would be complete when ECR access can be enforced at Pod or Namespace scope rather than only through node permissions; the issue names no repository files or tests.

Written by the indexing model from the issue text.