feat: Add opt-in aws:SourceArn condition to Karpenter controller IAM role trust policy

[ahauserv]

Description

Adds a new iam_role_source_arn_condition variable to the karpenter sub-module.
When set to true, an aws:SourceArn condition scoped to this cluster is added to the Karpenter controller IAM role's Pod Identity trust statement.

Motivation and Context

pods.eks.amazonaws.com names no cluster, so the controller role is assumable from any cluster in the account that can pass it.

This is the controller-side counterpart to #3695, which added the same opt-in for the node IAM role. The ARN is built from the existing locals the same way modules/fargate-profile builds its aws:SourceArn condition (#3039).
No new inputs or data sources.

Breaking Changes

None.
Opt-in, default false

How Has This Been Tested?

• I have updated at least one of the examples/* to demonstrate and validate my change(s)
• I have tested and validated these changes using one or more of the provided examples/* projects
• I have executed pre-commit run -a on my pull request

[ahauserv]

Validated against a live cluster. The Pre-Commit workflow is awaiting approval @bryantbiggs