AWS::EC2::VPC - CreateDefaultSecurityGroupRules / -- It should be possible to create VPC with an empty default security group

## 1. Title
AWS::EC2::VPC-CreateDefaultSecurityGroupRules

## 2. Scope of request
The AWS Foundational Security Best Practices controls [EC2.2] stipulates that the VPC default security group should not allow inbound and outbound traffic.

> We do not recommend using the default security group. Because the default security group cannot be deleted,
> you should change the default security group rules setting to restrict inbound and outbound traffic. This prevents
> unintended traffic if the default security group is accidentally configured for resources such as EC2 instances.

However, using CloudFormation there is no way to do this. You must either do it manually, script it, or create a custom
resource. None of these is particularly ideal. The latter options is likely the best current option but as it is considered best practice for the default security group to contain NO Ingress/Egress rules, it should be possible to do this via CloudFormation.

## 3. Expected behavior
This new attribute should have 4 options:
- None
- Ingress
- Egress
- All (default)
which will give users full control over the creation of the default security group's Ingress/Egress rules.

## 4. Suggest specific test cases

### VPC Creation
- [ ] If the new attribute is not provided, the default security group contains the same Ingress/Egress rules as it does today
- [ ] If the new attribute is provided with a Value of All, the default security group contains the same Ingress/Egress rules as it does today
- [ ] If the new attribute is provided with a Value of Ingress, the default security group contains the same Ingress rule that it does today, but no Egress rule
- [ ] If the new attribute is provided with a Value of Egress, the default security group contains the same Egress rule that it does today, but no Ingress rule
- [ ] If the new attribute is provided with a Value of None, the default security group contains no Ingress/Egress rules

### VPC Creation
- [ ] If the new attribute is not provided, the default security group is updated to contain the same Ingress/Egress rules as it does today
- [ ] If the new attribute is provided with a Value of All, the default security group is updated to contain the same Ingress/Egress rules as it does today
- [ ] If the new attribute is provided with a Value of Ingress, the default security group will be updated to remove the the default Egress rule, if it exists, and add the default Ingress rule, if it does not exist.
- [ ] If the new attribute is provided with a Value of Egress, the default security group will be updated to remove the the default Ingress rule, if it exists, and add the default Egress rule, if it does not exist.
- [ ] If the new attribute is provided with a Value of None, the default security group will be updated to remove the default Ingress, if it exists, and the default Egress rule, if it exists.

## 5. Helpful Links to speed up research and evaluation
- https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-standards-fsbp-controls.html#fsbp-ec2-3

## 6. Category (required) - Will help with tagging and be easier to find by other users to +1
Networking & Content