[AWS::EC2::SecurityGroup] silently failing to create Ingress rules if Cidr property not defined

### Name of the resource

AWS::EC2::SecurityGroup

### Resource Name

_No response_

### Issue Description

[AWS::EC2::SecurityGroup](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-ec2-security-group.html) is not explicitly rejecting deployments when the CidrIp property (for either [inline](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-ec2-security-group-rule-1.html#cfn-ec2-security-group-rule-cidrip ) or [AWS::EC2::SecurityGroupIngress](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-ec2-security-group-ingress.html)) is not defined, but rather allows deployment to succeed and silently not creating the actual ingress rule resource.

This not only results in stack drift, but more significantly, fools one into believing that the rule(s) has been created, when in reality it has not.

### Expected Behavior

Cloudformation should explicitly fail stack operations when ```CidrIp``` has not been appropriately defined. In other words, make the property required.

### Observed Behavior

If CidrIp property, either [inline](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-ec2-security-group-rule-1.html#cfn-ec2-security-group-rule-cidrip ) or [AWS::EC2::SecurityGroupIngress](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-ec2-security-group-ingress.html) has not been defined, the stack create/update will succeed, but the rule will be missing from the physical SecurityGroup.

### Drift results
Expected:
```
{
"GroupDescription": "Test",
"GroupName": "test-SG",
"SecurityGroupIngress": [
{
"CidrIp": "10.181.11.24/32",
"Description": "AttachedWithCidr",
"FromPort": 0,
"IpProtocol": "tcp",
"ToPort": 65535
},
{
"Description": "AttachedWithoutCidr",
"FromPort": 0,
"IpProtocol": "tcp",
"ToPort": 65535
},
{
"CidrIp": "10.106.32.0/22",
"Description": "Inline3-WithCidr",
"FromPort": 22,
"IpProtocol": "tcp",
"ToPort": 22
},
{
"CidrIp": "10.181.11.26/32",
"Description": "Inline2-WithCidr",
"FromPort": 22,
"IpProtocol": "tcp",
"ToPort": 22
},
{
"Description": "Inline1-WithoutCidr",
"FromPort": 22,
"IpProtocol": "tcp",
"ToPort": 22
}
],
"VpcId": "vpc-xxxxxxx"
}
```

Actual:
```
{
"GroupDescription": "Test",
"GroupName": "test-SG",
"SecurityGroupIngress": [
{
"CidrIp": "10.181.11.24/32",
"Description": "AttachedWithCidr",
"FromPort": 0,
"IpProtocol": "tcp",
"ToPort": 65535
},
{
"CidrIp": "10.106.32.0/22",
"Description": "Inline3-WithCidr",
"FromPort": 22,
"IpProtocol": "tcp",
"ToPort": 22
},
{
"CidrIp": "10.181.11.26/32",
"Description": "Inline2-WithCidr",
"FromPort": 22,
"IpProtocol": "tcp",
"ToPort": 22
}
],
"VpcId": "vpc-xxxxxxxxx"
}
```

### Test Cases

```aws cloudformation deploy --stack-name test --template-file security-groups.yaml --parameter-overrides VpcId=vpc-xxxxxxx ```

```
AWSTemplateFormatVersion: 2010-09-09
Description: Test

Parameters:
VpcId:
Type: AWS::EC2::VPC::Id

Resources:
SecurityGroup:
Type: AWS::EC2::SecurityGroup
Properties:
GroupName: !Sub "${AWS::StackName}-SG"
GroupDescription: "Test"
VpcId: !Ref VpcId
SecurityGroupIngress:
- Description: "Inline1-WithoutCidr"
IpProtocol: tcp
FromPort: 22
ToPort: 22
- Description: "Inline2-WithCidr"
IpProtocol: tcp
FromPort: 22
ToPort: 22
CidrIp: 10.181.11.26/32
- Description: "Inline3-WithCidr"
IpProtocol: tcp
FromPort: 22
ToPort: 22
CidrIp: 10.106.32.0/22
InboundRule1:
Type: AWS::EC2::SecurityGroupIngress
Properties:
Description: "AttachedWithCidr"
IpProtocol: tcp
FromPort: 0
ToPort: 65535
CidrIp: 10.181.11.24/32
GroupId:
Fn::GetAtt:
- SecurityGroup
- GroupId
InboundRule2:
Type: AWS::EC2::SecurityGroupIngress
Properties:
Description: "AttachedWithoutCidr"
IpProtocol: tcp
FromPort: 0
ToPort: 65535
GroupId:
Fn::GetAtt:
- SecurityGroup
- GroupId

```

### Other Details

_No response_

Start with the provided security-groups.yaml template and reproduce the deployment using the shown aws cloudformation deploy command. Compare the inline and AWS::EC2::SecurityGroupIngress rules with the resulting SecurityGroup and drift report; done means missing CidrIp is explicitly rejected instead of silently omitting the ingress rule.

Written by the indexing model from the issue text.