Support ECR pull-through cache repos

[artem-nefedov]

Description

Example CFN template should create node role with IAM permissions to pull images from ECR pull-through cache repositories (PTC).

Currently (v1.3.3), node role is missing ecr:BatchImportUpstreamImage permission, which is absent in AmazonEC2ContainerRegistryReadOnly managed policy and present in AmazonEC2ContainerRegistryPullOnly managed policy. This permission is required to be able to pull new images from PTC repos.

In general, AmazonEC2ContainerRegistryReadOnly can be replaced with AmazonEC2ContainerRegistryPullOnly with no downsides. This will also remove unneeded permissions defined in ReadOnly role, thus making it better suited for the least privilege principle, and match the current AWS recommendations for node role.

NOTE: EKS Auto Mode already uses AmazonEC2ContainerRegistryPullOnly.

[jonathan-innis]

Do you want to open a PR to make this change to our docs? Given that this is for creating new clusters, I think that it's fine to push this out if you want to open the PR

[artem-nefedov]

@jonathan-innis done, please check