CAPA: Add hidden flags --aws-prefix-list-id and --aws-transit-gateway-id for private clusters

[AndiDog]

What does this PR do?

Add necessary flags to create workload clusters on private CAPA MCs. Also, validate related inputs (topology mode, TGW/PL ID format).

What is the effect of this change to users?

We omit the fields if not specified, so no changes.

What does it look like?

apiVersion: v1
data:
  values: |
    # [...]
    network:
      apiMode: private
      availabilityZoneUsageLimit: 3
      dnsMode: private
      prefixListID: pl-abcdef123456
      # [...]
      topologyMode: UserManaged
      transitGatewayID: tgw-123456ghijkl
      vpcCIDR: 1.2.3.0/22
      vpcMode: private
    # [...]
kind: ConfigMap
metadata:
  creationTimestamp: null
  labels:
    giantswarm.io/cluster: andreas36
  name: andreas36-userconfig
  namespace: org-giantswarm

Any background context you can provide?

Needed for testing giantswarm/roadmap#1832 on private clusters.

What is needed from the reviewers?

@giantswarm/team-hydra please check thoroughly if the flag help text matches what we actually do topology-wise. I've explained it as I understand the networking right now.

Do the docs need to be updated?

Not yet. We will do that together with private cluster feature documentation.

Should this change be mentioned in the release notes?

• CHANGELOG.md has been updated

Is this a breaking change?

No