6097: Restrict default vpc security group

[ca61688]

Make sure you have checked all steps below.

Issue

• My PR fully resolves the following issues. I've referenced an issue in the PR title, for example "Issue 1234 - My
  Feature". Note that before an issue is finished, you can still make a pull request by raising a separate issue
  for your progress.
  • Resolves Restrict default security group in environment setup #6097

Tests

• My PR adds the following tests based on our test strategy OR does not need testing for this extremely good reason:
  • MyUnitTest

Documentation

• In case of new functionality, my PR adds documentation that describes how to use it, or I have linked to a
  separate issue for that below.
• If I have added new Java code, I have added Javadoc that explains it following our conventions and style.
• If I have added or removed any dependencies from the project, I have updated the NOTICES file.

[ca61688]

Ran the functional system tests using this branch. One quick test failed with a timeout but I don't think that's related to this change or we would have seen a lot more failures

[patchwork01]

This needs testing in a freshly deployed environment, with its own VPC:

scripts/cli/buildAll.sh # Will replace the currently installed CLI with a version built locally, including a build of cdk-environment
sleeper environment deploy <environment-id>
sleeper environment connect # This will SSH into the newly deployed EC2 in the newly deployed VPC
cloud-init status # Check this until cloud-init has finished installing everything in the EC2 (check /var/log/cloud-init-output.log for progress)
sleeper builder # Go into a builder container in the new EC2
cd sleeper
scripts/test/nightly/runTests.sh ... # Find the VPC and subnets to use here in the AWS console, use what you just deployed