feat: add node IAM additional policies variable

[kav]

Summary

• Adds node_iam_additional_policies variable (map(string), default {})
• Wires it into the default EKS managed node group as iam_role_additional_policies
• Allows attaching extra IAM policies to node group roles (e.g., KMS decrypt, SSM, custom policies)

Test plan

• Run tofu validate to verify syntax
• Run tofu plan with default (empty map) — no changes expected
• Run tofu plan with node_iam_additional_policies = { ssm = "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore" } — policy attachment should appear

🤖 Generated with Claude Code

[josmo]

this seems to have a bad merge? @kav are you letting claude run the show? ;)

[kav]

Oh man, probably not embarassingly enough, the number of merge conflicts in this set was nuts