add iptables rules to enforce access to kubelet and nodeports

[varun-armis]

Issue #, if available:

Description of changes:
Taking inspiration from this merged PR: #1687

It seems like explicitly adding the iptables rules expected (that are the defaults on Amazon Linux 2) would:

1. Bring more clarity to what the required iptables rules need to be for a working EKS node
2. Make it easier for Amazon Linux base image variants (e.g., hardened images) to work out of the box without requiring additions to user_data_file
3. Create a centralized place to make iptables updates which would resolve the confusion around this issue: Iptables rules in kubelet.service #332
4. Ensures that the image is responsible for iptables changes rather than kube-proxy which in turn could potentially make it easier for AWS support to address kube-proxy, VPC CNI issues.

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

Testing Done

I've only created a new AMI with these changes and verified that the new EKS node spins up into our EKS cluster