fix(security): resolve cluster SG from data source instead of variable

[agustincelentano]

Summary

The cluster_security_group_id variable was used in count expressions, but on first apply when EKS doesn't exist yet, its value is (known after apply) and OpenTofu can't evaluate the count during plan.

Now the module derives the primary SG internally from data.aws_eks_cluster.this[0].vpc_config[0].cluster_security_group_id (which resolves via depends_on), using the same override pattern as vpc_id and network_cidr:

• If cluster_security_group_id variable is provided -> use it (override)
• If not -> derive from the EKS data source

This eliminates the need for a second tofu apply on fresh setups.

Test plan

• Fresh apply with new EKS cluster — verify security module creates SG rules in single apply
• Existing setup with explicit cluster_security_group_id — verify override still works
• Plan without changes on existing infra — verify no diff