feat: Allow OIDC root CA thumbprint to be included/excluded

[danielfrankcom]

Description

This change adds a new include_oidc_root_ca_thumbprint input which allows the default root CA thumbprint to be included in or excluded from the OIDC thumbprint list.

Motivation and Context

As per #2768, I am not able to reliably retrieve the root CA thumbprint within a corporate environment where HTTPS traffic is intercepted and inspected.

I need a way to configure the EKS cluster to use the correct AWS CA thumbprint, rather than expecting the module to be able to query the thumbprint itself.

I could add the correct thumbprint to the existing custom_oidc_thumbprints list without this change, but there is a ~50% chance the root CA thumbprint will change every time I apply which creates churn in the configuration.

The wording of this input is based on the eks_oidc_root_ca_thumbprint input from an earlier version of this module.

• Resolves OIDC provider thumbprints inconsistent and sometimes incorrect #2768

Breaking Changes

The default value aligns with the current behavior, and the new input is not required. There should be no breaking change.

How Has This Been Tested?

• I have executed pre-commit run -a on my pull request

• I have updated at least one of the examples/* to demonstrate and validate my change(s)

• I have tested and validated these changes using one or more of the provided examples/* projects

I have not updated the examples/* since they do not currently use custom thumbprints, and most users would not need to I would think.

I tested this change by deploying a simple cluster with no configured OIDC inputs. The cluster was deployed with the single root CA thumbprint.

I then added the following configuration:

include_oidc_root_ca_thumbprint = false

When I applied the change, the resulting cluster had no thumbprints at all.

I then added the following configuration:

include_oidc_root_ca_thumbprint = false
custom_oidc_thumbprints   = [
  "9e99a48a9960b14926bb7f3b02e22da2b0ab7280"
]

When I applied the change, the resulting cluster had only the single custom thumbprint.

[denniskniep]

Great feature, this is awesome 👍

[bryantbiggs]

thank you! there should be additional changes in this space that makes this easier, but for the existing solution I think its worthwhile to add - so here we go 🚀 !

[antonbabenko]

This PR is included in version 19.20.0 🎉

[github-actions]

I'm going to lock this pull request because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues. If you have found a problem that seems related to this change, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.