Limit egress traffic to specific ranges and ports

[jamesbursa]

Currently the application security group allows egress traffic to all destinations and ports.

template-infra/infra/modules/service/main.tf

Lines 314 to 320 in a9c7665

	egress {
	description = "Allow all outgoing traffic from application"
	protocol = "-1"
	from_port = 0
	to_port = 0
	cidr_blocks = ["0.0.0.0/0"]
	}

We should be able to limit this to slightly reduce the possibility of security exploits (e.g. data exfiltration).

1. Allow database port (5432 if PostgreSQL) to database security group
2. Allow https (443) to all ips (unfortunately difficult to limit this due to CDNs for services like ECR, New Relic, etc.

For an example see https://github.com/navapbc/archive-massgov-pfml/blob/68377051147d230ed62303bcee8d059fa02aca3e/infra/api/template/security_groups.tf#L36-L79