[EKS] [Feature Request]: Allow Log Group To Be Specified For VPC CNI aws-network-policy-agent

### Community Note

* Please vote on this issue by adding a 👍 [reaction](https://blog.github.com/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/) to the original issue to help the community and maintainers prioritize this request
* Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
* If you are interested in working on this issue or have submitted a pull request, please leave a comment

**Tell us about your request**
Allow the CloudWatch Log Group for the aws-network-policy-agent logs to be specified.

**Which service(s) is this request for?**
EKS

**Tell us about the problem you're trying to solve. What are you trying to do, and why is it hard?**
A customer has a least-privilege requirement so they can't use **"Resource": "*"** as listed in the [recommended IAM Policy](https://docs.aws.amazon.com/eks/latest/userguide/cni-network-policy.html#network-policies-cwl-agent) for sending the aws-network-policy-agent logs to CloudWatch.

Specifying an existing log group (in this example, "NodeAgent"):

{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AmazonCloudWatchLogsReadWrite",
"Effect": "Allow",
"Action": [
"logs:CreateLogStream",
"logs:CreateLogGroup",
"logs:PutLogEvents",
"logs:DescribeLogGroups"
],
"Resource": [
"arn:aws:logs:::log-group:NodeAgent",
"arn:aws:logs:::log-group:NodeAgent:log-stream:*"
]
}
]
}
 
Or the default **/aws/eks/\/cluster** log group:

{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "VisualEditor0",
"Effect": "Allow",
"Action": [
"logs:DescribeLogGroups",
"logs:CreateLogGroup",
"logs:CreateLogStream",
"logs:PutLogEvents"
],
"Resource": [
"arn:aws:logs:::log-group:/aws/eks//cluster",
"arn:aws:logs:::log-group:/aws/eks//cluster:log-stream:*"
]
}
]
}
 
Cause the aws-eks-nodeagent container to go into CrashLoopBackOff.

The log group seems to be hard-coded in the aws-network-policy-agent:
https://github.com/aws/aws-network-policy-agent/blob/main/pkg/ebpf/events/events.go#L96

**Are you currently working around this issue?**
N/A

Start with pkg/ebpf/events/events.go around line 96 in the linked aws-network-policy-agent repository, where the log group is reported as hard-coded. Trace how the agent is configured and identify the relevant validation or integration coverage. Done means an existing log group can be specified without the aws-eks-nodeagent entering CrashLoopBackOff under the least-privilege IAM policy.

Written by the indexing model from the issue text.