feat: Wire existing checks for eks-cis-1.4

[mattcarp12]

Wire existing checks to eks-cis-1.4 compliance spec

Map existing AWS EKS and Kubernetes checks to controls that
previously had no automated checks:

• 2.1.1 (audit logs) -> AWS-0038
• 3.2.7 (eventRecordQPS) -> KCV-0087
• 4.1.6 (SA token mounting) -> KSV-0036
• 5.3.1 (secrets encryption) -> AWS-0039
• 5.4.1 (endpoint access restriction) -> AWS-0041
• 5.4.2 (private endpoint) -> AWS-0040