Improve IDMSv2 security

[T-Kukawka]

CAPA GS implementation supports toggling the IMDS(instance metadata service) to v2 only. By default on any new CAPA clusters the setting global.providerSpecific.instanceMetadataOptions.httpTokens is set to required in the WC configmap.

However, while being more secured than v1, the IMDSv2 endpoint can still be abused. For the pods that are enforced not to run in the host network, there is another layer of configuration that can be performed. As stated in the official AWS documentation:

Another way to block pod IMDS access is to require IMDS version 2 (IMDSv2) to be used, and to set the maximum [hop count](https://hopzero.com/what-does-hop-count-mean/) to 1. Configuring IMDS this way will cause requests to IMDS from pods to be rejected, provided those pods do not use host networking.

Action points:

• expose configuration of hop count on the EC2 instance settings in cluster-aws that is available in upstream CAPA implementation under: instanceMetadataOptions.HttpPutResponseHopLimit
• configure HttpPutResponseHopLimit to be set to 1 by default

[T-Kukawka]

Relevant issue for reverting hop=1: https://github.com/giantswarm/giantswarm/issues/22043