Migrate bastion to the new VPC

[marcoieni]

Bastion lives in a separate vpc (the legacy one) compared to the rds (the "new") one, so the security group is needed to allow access to rds from outside the vpc.

if the bastion were to be migrated to the new vpc there would be no need anymore as bastion <-> rds would be intra-vpc traffic

More context on zulip