AWS::MSK::Cluster - Changing BrokerNodeGroupInfo/SecurityGroups causes replacement

### Name of the resource

AWS::MSK::Cluster

### Resource Name

_No response_

### Issue Description

When I'm changing the security groups for the broker node group, Cloudformation wants to replace the whole MSK resource, whereas it seems completely fine to change the security groups on the ENIs through the AWS console. I'm not sure why the replacement seems necessary, when it could just swap the security groups on the ENIs?

It also seems to leave the ENIs when removing a stack with an MSK, which also seems broken, leaving the security group non-deletable. Not sure if this is related.

### Expected Behavior

I'd expect a replacement of a security group to just change the security groups on the ENI interfaces, not affecting the cluster.

### Observed Behavior

It tries to replace the whole cluster, which also fails if the cluster has a static name (hence Why I noticed it). A cluster replacement like this inherently also looses all data, I'd recon.

### Test Cases

Just wire up an MSK cluster with a security group.

Later change the security group to something else.

### Other Details

_No response_

No repository files or test entry points are named. Reproduce the AWS::MSK::Cluster case by changing BrokerNodeGroupInfo/SecurityGroups, then test stack deletion and compare the CloudFormation behavior with the AWS console. Done means the expected update and ENI cleanup behavior is established and the issue has an actionable implementation path.

Written by the indexing model from the issue text.