Ensure node-groups have encrypted root volumes

[addisonj]

We should default our node-groups to use encrypted root volumes.

This will better comply with our security policies of encryption by default

[jrsdav]

Looks like they added support for this through a launch config.
aws/containers-roadmap#585 (comment)

I'll dig into the parent EKS module we're using to see how I create and pass one to the node_groups sub module.
https://github.com/terraform-aws-modules/terraform-aws-eks/blob/master/modules/node_groups/launch_template.tf

[jrsdav]

Example of enabling it in the module:
https://github.com/terraform-aws-modules/terraform-aws-eks/blob/9022013844a61193a2f8764311fb679747807f5c/examples/launch_templates_with_managed_node_groups/launchtemplate.tf#L32