[EKS] [Auto Mode Documentation]: Add best practice network policies for EKS Auto Mode

### Community Note

* Please vote on this issue by adding a 👍 [reaction](https://blog.github.com/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/) to the original issue to help the community and maintainers prioritize this request
* Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
* If you are interested in working on this issue or have submitted a pull request, please leave a comment

**Tell us about your request**
It would be good to have some documented Auto Mode best practices, as some of the EKS Best Practice documentation seems to not apply to Auto Mode - https://docs.aws.amazon.com/eks/latest/best-practices/introduction.html

**Which service(s) is this request for?**
EKS Auto Mode

**Tell us about the problem you're trying to solve. What are you trying to do, and why is it hard?**
I've enabled network policies on my EKS Auto Mode Cluster, with the nodeclass set to "DefaultDeny" for pod isolation. I'd still like pods to be able to resolve dns queries, which would typically be done by adding a network policy to allow all pods to communicate with kube-dns in the kube-system namespace - however this did not work for me.

I discovered that the nameserver pods had in /etc/resolv.conf was 10.100.0.10, so I allowed access to my service range (10.100.0.0/16) on UDP/53 for all pods - which made DNS work. I'd imagine this is fine to reduce down to 10.100.0.10 specifically, but there is no documentation saying that this will always be the DNS IP (especially as the service range is user defined). It would be good for some best practice network policies to be documented for Auto Mode, as the de facto standard policies seem to no longer apply when we have no visibility of AWS managed cluster addons.

**Are you currently working around this issue?**
As mentioned above, I've specified a large range to be safe, although I'd prefer to reduce this as it also opens up anything else in that range on port 53.

**Additional context**
Anything else we should know?

**Attachments**
If you think you might have additional information that you'd like to include via an attachment, please do - we'll take a look. (Remember to remove any personally-identifiable information.)

Start with the linked EKS Best Practices documentation and the EKS Auto Mode network-policy behavior described in the issue. Investigate how DNS resolution works when the node class is set to DefaultDeny, including the kube-dns nameserver at 10.100.0.10 and the user-defined service range. Done means documenting tested, least-privilege network-policy best practices for Auto Mode.

Written by the indexing model from the issue text.