[EKS] [request]: Allow specifying which admission controllers are enabled

### Community Note

* Please vote on this issue by adding a 👍 [reaction](https://blog.github.com/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/) to the original issue to help the community and maintainers prioritize this request
* Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
* If you are interested in working on this issue or have submitted a pull request, please leave a comment

**Tell us about your request**
When I create an EKS cluster, I'd like to specify which of the _compiled-in_ admission controllers are enabled.

**Which service(s) is this request for?**
EKS

**Tell us about the problem you're trying to solve. What are you trying to do, and why is it hard?**
According to the [documentation](https://docs.aws.amazon.com/eks/latest/userguide/platform-versions.html), there is an immutable list of admission controllers that are enabled by default for each EKS version. I'd like to use the _AlwaysPullImages_ admission controller without using [dynamic admission control](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/).

**Are you currently working around this issue?**
Since the _AlwaysPullImages_ is the only admission controller for which I'd like to have this, I use immutable image tags.

Start with the EKS platform-versions documentation and Kubernetes documentation on dynamic admission control, then examine how EKS cluster creation exposes admission-controller settings. The work is done when cluster creation can specify which compiled-in admission controllers are enabled, including AlwaysPullImages, without requiring dynamic admission control.

Written by the indexing model from the issue text.