Fix bastion security groups

We provision bastion with

```
security_groups = ["${module.sg-default.security_group_id}", "${aws_security_group.bastion.id}"]
```

This actual means bastion is connectable on any port (default security group is open). It shouldn't be the case

This isn't actual a problem specific to coreOS - it exists in master as well AFAIK