Cloudstack Affinity Group should be evaluated with Account during preflights

EKS-A supports attaching affinity groups to control plane, etcd and worker node groups. Affinity here can be either `pro` or `anti`. Another way to define affinity groups is to attach pre-existing affinity groups defined in Cloudstack environment.

If affinity group ID are provided to EKS-A, preflight validations just validate the existence of the provided groups. It should also validate if the account has enough permissions to schedule and/or use those provided groups.

No files or tests are named. Locate the preflight validation entry point for CloudStack affinity group IDs, then inspect the existing existence checks and account permissions needed to schedule or use those groups. Done means preflights reject groups the account cannot use and accept permitted groups.

Written by the indexing model from the issue text.