Add CloudFormation benchmark options

[rgarcia]

Summary

• add optional HTTP/HTTPS ingress parameters for the quickstart security group
• add gp3 IOPS and throughput parameters for the Hypeman data volume
• move root/data block-device mappings into the launch template helper so gp3 throughput and nested virtualization are configured together
• extend CloudFormation template contract tests for the new parameters and launch-template payload

Tests

• go test ./... (deploy/aws/cloudformation)
• git diff --check origin/main...HEAD

---

Note

Medium Risk
Moderate risk because it changes EC2 launch configuration (block device mappings now created via a custom launch template) and adds new optional inbound network exposure, which can affect instance replacement and security group behavior.

Overview
Adds optional CloudFormation parameters to open HTTP (80) and HTTPS (443) ingress (guarded by UseHttpIngress/UseHttpsIngress) from a new AllowedIngressCidr, alongside the existing API/SSH rules.

Introduces DataVolumeIops and DataVolumeThroughput knobs for the gp3 data EBS volume, and moves both root/data block device mappings into the custom launch-template Lambda so gp3 throughput and nested virtualization are configured together.

Updates the Go contract tests to cover the new parameters, conditional ingress rules, and the expanded launch template payload/properties.

^{Reviewed by Cursor Bugbot for commit a806d21. Bugbot is set up for automated code reviews on this repo. Configure here.}

[firetiger-agent]

Firetiger deploy monitoring skipped

This PR didn't match the auto-monitor filter configured on your GitHub connection:

Any PR that changes the kernel API. Monitor changes to API endpoints (packages/api/cmd/api/) and Temporal workflows (packages/api/lib/temporal) in the kernel repo

Reason: Changes are limited to CloudFormation templates and AWS deployment configuration, not to API endpoints or Temporal workflows.

To monitor this PR anyway, reply with @firetiger monitor this.