Make security_group_id configurable on ec2_instance

[n1hility]

Description

Add a security_group_id to ec2_instance to allow for usage of a non-default security group.

Context

The main use case is to be able to additionally firewall a particular instance type where you have mixed configurations. As an example you may wish to allow inbound traffic to linux nodes, but drop everything going to windows nodes.

It appears this might have been considered in the past, but lost out to subnets: https://github.com/cirruslabs/cirrus-ci-docs/pull/1026

While you could achieve a similar solution using an ACL on a non-default subnet, subnets lock you into a single availability zone. The AWS docs warn that a zone may refuse to schedule if a capacity limit is reached (or of course if there is an outage). Additionally you have the maintenance burden of carving up CIDR blocks vs a more generic, reusable default subnet pool.