#3156 feat(2386): Add wide permissions to creation flow

Summary

Issue:

Screenshots / Recordings

For organizations with feature flag:

• toggle off (disabled by default):

  

• toggle on:

  

Testing

• Changes tested locally in the relevant Console's pages and Storybooks
• yarn test or yarn test -u (if you need to regenerate snapshots)
• yarn format
• yarn lint

PR Checklist

• I followed naming, styling, and TypeScript rules (see .cursor/rules)
• I performed a self-review (diff inspected, dead code removed)
• I titled the PR using Conventional Commits with a scope when possible (e.g. feat(service): add new Terraform service) - required for semantic-release
• I only kept necessary comments, written in English (watch for useless AI comments)
• I involved a designer to validate UI changes if I am not a designer
• I covered new business logic with tests (unit)
• I confirmed CI is green (Codecov red can be accepted)
• I reviewed and executed locally any AI-assisted code

---

Summary by cubic

Adds a restrictive-permissions mode to the AWS managed cluster creation flow so clusters run on restricted credentials by default and request extended credentials only when wider access is needed.

• Gated behind the wide-credentials PostHog feature flag for managed AWS clusters.
• The toggle defaults to off, and using_restrictive_permissions is registered on the form in both creation and edit flows.
• With the toggle on, extended credentials are limited to AWS roles, and a restricted credentials selector plus a Slack webhook URL appear; with it off, all credential types are selectable.
• The Slack webhook URL is validated against hooks.slack.com in both the creation flow and the edit-cluster credentials settings.
• The summary step sends restricted credentials as cloud_provider_credentials, extended credentials as wide_permission_credentials, plus a wide_permissions payload block.
• EKS Anywhere clusters keep the existing credential flow when the flag is enabled.