feat(ec2): add allowAllSelf to SecurityGroup

[lemon0333]

Issue # (if applicable)

Closes #38558.

Reason for this change

There is no single SecurityGroup prop to allow all traffic to self. This configuration (a self-referencing ingress and egress rule for all protocols/ports) is exactly what Elastic Fabric Adapter (EFA) network interfaces require. Today users have to either drop to connections.allowInternally(Port.allTraffic()) with allowAllOutbound: false, or use an L1 escape hatch (CfnSecurityGroupEgress) to get the egress half when allowAllOutbound is left at its default. This is a discoverability/ergonomics gap that @pahud greenlit in the issue.

Description of changes

• Add readonly allowAllSelf?: boolean (@default false) to SecurityGroupProps.
• In the SecurityGroup constructor, when allowAllSelf is true, create the self-referencing all-traffic ingress and egress rules (the ergonomic equivalent of connections.allowInternally(Port.allTraffic())).

Egress semantics (the design gotcha @pahud flagged): with the default allowAllOutbound: true, addEgressRule normally drops explicit egress rules because it assumes the implicit "all traffic to 0.0.0.0/0" rule subsumes them. That assumption is not valid for a self-referencing security-group egress rule — which is precisely what EFA needs. So I chose the preferred option from the two discussed: always emit the self egress rule regardless of allowAllOutbound, by bypassing the subsumption shortcut for this one explicit self-rule (a SecurityGroup peer has canInlineRule === false, so the normal path already delegates to super.addEgressRule — calling it directly produces the identical CfnSecurityGroupEgress, same scope and id, just without the shortcut). When allowAllOutbound: false, the regular path is used (which also cleans up the placeholder "no traffic" egress rule).

Net effect: new ec2.SecurityGroup(this, 'EfaSg', { vpc, allowAllSelf: true }) yields the exact EFA configuration in one line while keeping the default allowAllOutbound: true behavior for every other rule unchanged. I rejected the stricter alternative (throw/validate that allowAllSelf requires allowAllOutbound: false) because it would force users to give up all-outbound access to get a self egress rule, which isn't necessary. @pahud — happy to switch to the stricter variant if you'd prefer it.

The prop doc-comment and a new README section document the exact semantics and the allowAllOutbound interaction.

Describe any new or updated permissions being added

None.

Description of how you validated changes

• Unit tests (aws-ec2/test/security-group.test.ts, new allowAllSelf describe block, 3 tests; full file 133/133 passing):
  • self ingress + egress all-traffic rules created with the default allowAllOutbound: true, and the default all-outbound rule on the group is preserved;
  • self ingress + egress created with allowAllOutbound: false (placeholder no-traffic egress rule removed);
  • no self rules created when allowAllSelf is false/omitted.
• Integ test (integ.security-group-allow-all-self.ts) covering both allowAllOutbound default and false, with snapshot committed. The snapshot confirms both groups emit a self-referencing ingress and egress rule (IpProtocol: -1, referencing the group itself), including the default-allowAllOutbound group.
• README section added to aws-ec2/README.md documenting allowAllSelf and the allowAllOutbound interaction.

Checklist

• My code adheres to the CONTRIBUTING GUIDE and DESIGN GUIDELINES

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license