aws: scope Karpenter controller IAM permissions - #18582

Scope the mutating actions of the Karpenter controller policy, following the
upstream reference policy:

* iam:PassRole is limited to the worker node role and to the EC2 service.
  For instance groups that use a custom IAM instance profile, granting
  iam:PassRole on the role it contains is the responsibility of whoever
  manages that profile.
* ec2:RunInstances, ec2:CreateFleet and ec2:CreateLaunchTemplate require the
  created resources to be tagged with the cluster tag and the
  karpenter.sh/nodepool tag, with an unconditional resource-scoped statement
  for the untagged resources they reference (AMI, snapshots, subnets,
  security groups, capacity reservations).
* ec2:TerminateInstances, ec2:DeleteLaunchTemplate, ec2:CreateTags and
  ec2:DeleteTags are only allowed on resources with the cluster tag and the
  karpenter.sh/nodepool tag.
* The instance profile mutations are removed, as kOps supplies the instance
  profile through the EC2NodeClass spec, so Karpenter never creates or
  mutates instance profiles.

Read-only actions remain unconditional.

Instance groups with custom IAM instance profiles contain roles with names
that kOps cannot predict. When a Karpenter-managed instance group uses one,
allow the Karpenter controller to pass any role to EC2.