update aws-node clusterrole permissions

[sushrk]

What type of PR is this?
bug, cleanup

Which issue does this PR fix:
N/A

What does this PR do / Why do we need it:
Updates aws-node clusterrole permissions to have the least required permissions

If an issue # is not available please add repro steps and logs from IPAMD/CNI showing the issue:
N/A

Testing done on this change:
Ran the relevant integration test:

[9/08/22 10:32:01] ➜  ipamd git:(eaca3fe5) ✗ ginkgo -v -timeout 10m --fail-on-pending -- \
 --cluster-kubeconfig=$KUBECONFIG \
 --cluster-name=$CLUSTER_NAME \
 --aws-region=$AWS_REGION \
 --aws-vpc-id=$VPC_ID \
 --ng-name-label-key=$NG_NAME_LABEL_KEY \
 --ng-name-label-val=$NG_NAME_LABEL_VAL
Running Suite: VPC IPAMD Test Suite - /Users/ravsushm/go/src/github.com/aws/amazon-vpc-cni-k8s/test/integration/ipamd
=====================================================================================================================
Random Seed: 1660066326

Will run 1 of 26 specs
------------------------------
[BeforeSuite] 
/Users/ravsushm/go/src/github.com/aws/amazon-vpc-cni-k8s/test/integration/ipamd/ipamd_suite_test.go:32
I0809 10:32:30.451424   48615 request.go:665] Waited for 1.001363345s due to client-side throttling, not priority and fairness, request: GET:https://1C30ABE12DEABC4CBA07E6115710E11D.yl4.us-west-2.eks.amazonaws.com/apis/coordination.k8s.io/v1?timeout=32s
STEP: creating test namespace 08/09/22 10:32:32.241
STEP: removing the environment variables from the ds map[MINIMUM_IP_TARGET:{} WARM_ENI_TARGET:{} WARM_IP_TARGET:{} WARM_PREFIX_TARGET:{}] 08/09/22 10:32:33.083
STEP: getting the aws-node daemon set in namesapce kube-system 08/09/22 10:32:33.083
STEP: updating the daemon set with new environment variable 08/09/22 10:32:33.284
------------------------------
[BeforeSuite] PASSED [25.348 seconds]
[BeforeSuite] 
/Users/ravsushm/go/src/github.com/aws/amazon-vpc-cni-k8s/test/integration/ipamd/ipamd_suite_test.go:32

  Begin Captured GinkgoWriter Output >>
    STEP: creating test namespace 08/09/22 10:32:32.241
    STEP: removing the environment variables from the ds map[MINIMUM_IP_TARGET:{} WARM_ENI_TARGET:{} WARM_IP_TARGET:{} WARM_PREFIX_TARGET:{}] 08/09/22 10:32:33.083
    STEP: getting the aws-node daemon set in namesapce kube-system 08/09/22 10:32:33.083
    STEP: updating the daemon set with new environment variable 08/09/22 10:32:33.284
  << End Captured GinkgoWriter Output
------------------------------
SSSSSSSSS
------------------------------
[1.11.3] test aws-node pod event when iam role is missing VPC_CNI policy
  unauthorized event must be raised on aws-node pod
  /Users/ravsushm/go/src/github.com/aws/amazon-vpc-cni-k8s/test/integration/ipamd/ipamd_event_test.go:105
STEP: getting the iam role 08/09/22 10:32:53.513
STEP: detaching VPC_CNI policy and restart aws-node pods 08/09/22 10:32:53.814
STEP: checking aws-node pods not running 08/09/22 10:33:44.627
STEP: attaching VPC_CNI policy and restart aws-node pods 08/09/22 10:33:49.627
STEP: checking aws-node pods are running 08/09/22 10:34:28.062
------------------------------
• [SLOW TEST] [104.551 seconds]
[1.11.3] test aws-node pod event
/Users/ravsushm/go/src/github.com/aws/amazon-vpc-cni-k8s/test/integration/ipamd/ipamd_event_test.go:33
  when iam role is missing VPC_CNI policy
  /Users/ravsushm/go/src/github.com/aws/amazon-vpc-cni-k8s/test/integration/ipamd/ipamd_event_test.go:36
    unauthorized event must be raised on aws-node pod
    /Users/ravsushm/go/src/github.com/aws/amazon-vpc-cni-k8s/test/integration/ipamd/ipamd_event_test.go:105

  Begin Captured GinkgoWriter Output >>
    STEP: getting the iam role 08/09/22 10:32:53.513
    STEP: detaching VPC_CNI policy and restart aws-node pods 08/09/22 10:32:53.814
    STEP: checking aws-node pods not running 08/09/22 10:33:44.627
    STEP: attaching VPC_CNI policy and restart aws-node pods 08/09/22 10:33:49.627
    STEP: checking aws-node pods are running 08/09/22 10:34:28.062
  << End Captured GinkgoWriter Output
------------------------------
SSSSSSSSSSSSSSSS
------------------------------
[AfterSuite] 
/Users/ravsushm/go/src/github.com/aws/amazon-vpc-cni-k8s/test/integration/ipamd/ipamd_suite_test.go:61
STEP: deleting test namespace 08/09/22 10:34:38.073
------------------------------
[AfterSuite] PASSED [6.436 seconds]
[AfterSuite] 
/Users/ravsushm/go/src/github.com/aws/amazon-vpc-cni-k8s/test/integration/ipamd/ipamd_suite_test.go:61

  Begin Captured GinkgoWriter Output >>
    STEP: deleting test namespace 08/09/22 10:34:38.073
  << End Captured GinkgoWriter Output
------------------------------

Ran 1 of 26 Specs in 136.351 seconds
SUCCESS! -- 1 Passed | 0 Failed | 0 Pending | 25 Skipped
PASS | FOCUSED

Automation added to e2e:
N/A, test already present

Will this PR introduce any new dependencies?:
No.

Will this break upgrades or downgrades. Has updating a running cluster been tested?:
No, upgrade from 1.11.2 tested.

Does this change require updates to the CNI daemonset config files to work?:
Yes, updated.

Does this PR introduce any user-facing change?:
No.

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

[jayanthvn]

lgtm

[jayanthvn]

Since it is just a manifest update, overriding arm64 build.

[dudicoco]

@sushrk list permissions also grant permissions to get the object contents, just like get permissions: https://kubernetes.io/docs/reference/access-authn-authz/authorization/#determine-the-request-verb