[EKS] [AutoMode] [request]: Allow configuring user.max_user_namespaces in EKS Auto Mode to support rootless CI/CD container builds

### Community Note

* Please vote on this issue by adding a 👍 [reaction](https://blog.github.com/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/) to the original issue to help the community and maintainers prioritize this request
* Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
* If you are interested in working on this issue or have submitted a pull request, please leave a comment

**Describe the feature request:**
We are migrating our internal CI/CD infrastructure (GitLab Runners) to EKS Auto Mode to take advantage of AWS's managed compute and secure defaults. However, we are completely blocked from securely building Docker images because EKS Auto Mode hardcodes user.max_user_namespaces=0.

We are requesting the ability to configure user.max_user_namespaces (or explicitly allow this sysctl) within the EKS Auto Mode NodeClass configuration.

**Describe the use case and business impact:**
Modern CI/CD container ecosystems have entirely deprecated privileged Docker daemons (like Docker-in-Docker) in favor of secure, rootless builders like BuildKit and Buildah. Because the Kaniko project is now deprecated, BuildKit is the industry standard.

BuildKit fundamentally relies on Linux User Namespaces to securely isolate image builds without requiring root access to the underlying host. Because EKS Auto Mode sets user.max_user_namespaces=0 and locks down the NodeClass user-data, our pipeline jobs immediately crash with "no space left on device" (namespace exhaustion) when BuildKit attempts to initialize.

**Describe the current workaround:**
Because we cannot configure this natively in EKS Auto Mode, we are forced to deploy a highly privileged Kubernetes DaemonSet to our cluster. This DaemonSet deploys a root container onto every new Auto Mode node specifically to run sysctl -w user.max_user_namespaces=63359 against the live host kernel at runtime.

This workaround creates a glaring security paradox: to use AWS's highly-secure Auto Mode compute, we are forced to run highly-privileged cluster workloads to hack the kernel at runtime just to support industry-standard CI/CD tools.

Allowing us to enable User Namespaces natively via the Auto Mode API would allow us to drop these privileged DaemonSets, embrace rootless CI/CD builds, and fully adopt EKS Auto Mode for our infrastructure.

Start by reviewing the EKS Auto Mode NodeClass configuration and how it handles user.max_user_namespaces and locked-down user data. The work is done when Auto Mode natively permits configuring this sysctl for rootless BuildKit or Buildah builds, eliminating the privileged DaemonSet workaround.

Written by the indexing model from the issue text.