fix(iam)!: deprecate OpenIdConnectProvider public API

[iankhou]

Issue

Closes #20460.

Reason for this change

OpenIdConnectProvider, which uses CustomResource, should no longer be used. However, we still use it in EKS. It is superseded by OIDCProviderNative, which provides the same functionality by using the native CloudFormation resource, with less infrastructure complexity.

Description of changes

Introduced internal construct OpenIdConnectProviderInternal, which is a drop-in replacement for OpenIdConnectProvider, and changed EKS to use that. The change is breaking because we are changing the type that EKS is extending in its own implementation of OpenIdConnectProvider from OpenIdConnectProvider to OpenIdConnectProviderInternal.

Extend OpenIdConnectProviderInternal with OpenIdConnectProvider, but deprecate it.

Describe any new or updated permissions being added

None.

Description of how you validated changes

Ran unit and integration tests. No feature changes.

Checklist

• My code adheres to the CONTRIBUTING GUIDE and DESIGN GUIDELINES

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

[aws-cdk-automation]

(This review is outdated)

✅ Updated pull request passes all PRLinter validations. Dismissing previous PRLinter review.

[aws-cdk-automation]

The pull request linter fails with the following errors:

❌ Fixes must contain a change to a test file.
❌ Fixes must contain a change to an integration test file and the resulting snapshot.
❌ The title prefix of this pull request must be one of "feat|fix|build|chore|ci|docs|style|refactor|perf|test|revert"

If you believe this pull request should receive an exemption, please comment and provide a justification. A comment requesting an exemption should contain the text Exemption Request. Additionally, if clarification is needed, add Clarification Request to a comment.

[aws-cdk-automation]

➡️ PR build request submitted to test-main-pipeline ⬅️

A maintainer must now check the pipeline and add the pr-linter/cli-integ-tested label once the pipeline succeeds.

[github-actions]

Comments on closed issues and PRs are hard for our team to see.
If you need help, please open a new issue that references this one.