Too permissive IAM policy for CA associated to controller nodes

[mumoshu]

The IAM policy associated to controller nodes is unnecessarily permissive for running CA.

{
                "Effect": "Allow",
                  "Action": [
                    "autoscaling:DescribeAutoScalingGroups",
                    "autoscaling:DescribeAutoScalingInstances",
                    "autoscaling:DescribeTags",
                    "autoscaling:SetDesiredCapacity",
                    "autoscaling:TerminateInstanceInAutoScalingGroup"
                  ],
                  "Resource": "*"
                },

What we actually want instead would look exactly same as the one for worker nodes:

{
                  "Action": [
                    "autoscaling:DescribeAutoScalingGroups",
                    "autoscaling:DescribeAutoScalingInstances",
                    "autoscaling:DescribeTags",
                  ],
                  "Effect": "Allow",
                  "Resource": "*"
                },
                {
                  "Action": [
                    "autoscaling:SetDesiredCapacity",
                    "autoscaling:TerminateInstanceInAutoScalingGroup"
                  ],
                  "Condition": {
                    "Null": { "autoscaling:ResourceTag/kubernetes.io/cluster/{{.ClusterName}}": "false" }
                  },
                  "Effect": "Allow",
                  "Resource": "*"
                },

The latter is better because it prevents any app running on the nodes from terminating EC2 instances outside of the K8S cluster. For instance, it would have prevented a misbehaving CA to terminate EC2 instances outside of the K8S cluster like we experienced in #800.