fix(eks): overly permissive trust policies (#25473)

The *CreationRole* and the *default MastersRole* use the account root principal in their trust policy, which is overly permissive. Instead, use the specific lambda handler roles that need it, and remove the default masters role.

BREAKING CHANGE: A masters role is no longer provisioned by default. Use the `mastersRole` property to explicitly pass a role that needs cluster access. In addition, the creation role no longer allows any identity (with the appropriate `sts:AssumeRole` permissions) to assume it. 

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

Author: iliapolo

packages/@aws-cdk-testing/framework-integ/test/aws-eks/test/integ.alb-controller.js.snapshot/asset.68b8fc42fe6d1eb6e6c39212ce770fac02511440fecfc5b69a904fe8a19f6b8e/index.js

@@ -1,5 +1,5 @@
-import { IsCompleteResponse, OnEventResponse } from '../../../custom-resources/lib/provider-framework/types';
 import { EksClient, ResourceEvent, ResourceHandler } from './common';
+import { IsCompleteResponse, OnEventResponse } from '../../../custom-resources/lib/provider-framework/types';
 export declare class ClusterResourceHandler extends ResourceHandler {
     get clusterName(): string;
     private readonly newProps;

packages/@aws-cdk-testing/framework-integ/test/aws-eks/test/integ.eks-service-account-sdk-call.js.snapshot/asset.c33f77e71bef2fbd8299fa87f0d89b792b981d73e22dba92b2dd13caec415dfc.zip renamed to packages/@aws-cdk-testing/framework-integ/test/aws-eks/test/integ.alb-controller.js.snapshot/asset.6a28458f7bc3d04e4d2b17f9c3da0709bf456e34b06ea7c96111eecb2fddd054.zip

@@ -1,11 +1,11 @@
 /* eslint-disable no-console */
 
 // eslint-disable-next-line import/no-extraneous-dependencies
-import { IsCompleteResponse, OnEventResponse } from '../../../custom-resources/lib/provider-framework/types';
 // eslint-disable-next-line import/no-extraneous-dependencies
 import * as aws from 'aws-sdk';
 import { EksClient, ResourceEvent, ResourceHandler } from './common';
 import { compareLoggingProps } from './compareLogging';
+import { IsCompleteResponse, OnEventResponse } from '../../../custom-resources/lib/provider-framework/types';
 
 
 const MAX_CLUSTER_NAME_LEN = 100;

packages/@aws-cdk-testing/framework-integ/test/aws-eks/test/integ.alb-controller.js.snapshot/asset.75dfa9114a30421542432dcb55212f010f591a9e3bd203ae98ba3f9bedf5bb31.zip

@@ -1,5 +1,5 @@
-import { IsCompleteResponse, OnEventResponse } from '../../../custom-resources/lib/provider-framework/types';
 import * as aws from 'aws-sdk';
+import { IsCompleteResponse, OnEventResponse } from '../../../custom-resources/lib/provider-framework/types';
 export interface EksUpdateId {
     /**
      * If this field is included in an event passed to "IsComplete", it means we