upgrade the eks module to v21.23.0

[hvtonev]

No description provided.

[hvtonev]

• AmazonEKSVPCResourceController attachment: moved from the old v20 internal address to
  iam_role_additional_policies; preserves the existing classic-mode attachment.

• module.eks[0].module.eks.aws_iam_policy.custom[0]: destroyed; Auto Mode custom-tag policy
  that was created by v20 even though Auto Mode is not used here.

• module.eks[0].module.eks.aws_iam_role_policy_attachment.custom[0]: destroyed; attachment
  for the unused Auto Mode custom-tag policy above.

• EKS cluster: updated in-place; upstream v21 removes the internal terraform-aws-modules =
  eks tag.

• EKS KMS key: updated in-place; same upstream module tag cleanup.

• Node security group rule ingress_cluster_10251_webhook: created; v21 adds the current
  metrics-server webhook port rule.

• 2 Karpenter CloudWatch/EventBridge resources: created; v21 adds capacity reservation
  interruption handling and routes those events to the existing Karpenter interruption
  queue.

• Karpenter SQS queue policy: updated in-place; v21 changes the insecure transport condition
  from StringEquals to Bool, same policy intent.

• Extra permissions to the Karpenter IRSA policy: updated in-place; required by newer
  Karpenter v1 behavior for capacity reservations, placement groups, instance status, and
  zonal shift.