Support Security Group or Equivalent Network Policy for App Runner Services

**Community Note**
* Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
* Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do * not help prioritize the request
If you are interested in working on this issue or have submitted a pull request, please leave a comment

**Tell us about your request**
Enable attaching Amazon EC2 security groups (or an equivalent first-class network policy) to AWS App Runner services directly. The goal is to natively define inbound and outbound network controls at the App Runner service boundary, including allow/deny rules by CIDR and/or AWS-managed prefix lists. This would let customers explicitly restrict:

- Ingress to approved sources (e.g., CloudFront, Route 53 health checks only).
- Egress to approved destinations (e.g., specific services or IP ranges).

This capability should be available without forcing the service into a customer-managed VPC or introducing additional infrastructure components.

**Describe alternatives you've considered**
Today, achieving comparable network restrictions generally requires deploying into a VPC and/or placing intermediaries such as AWS WAF, load balancers, NAT Gateways, and interface VPC endpoints. These patterns add operational overhead and significant cost (e.g., NAT, endpoints, per-request WAF charges), which runs counter to App Runner’s whole value proposition of low-ops, serverless simplicity.

**Additional context**
My use case aligns with #187 but targets a different implementation path. In multi-Region deployments where App Runner services are fronted by Route 53 latency-based routing record, Amazon CloudFront, and AWS WAF, we need to ensure that origin access is strictly limited to CloudFront. This prevents end users from bypassing the CDN and its WAF protections to reach App Runner endpoints directly.

Native, security group–style ingress and egress controls (or an equivalent network policy mechanism) within App Runner would enable this origin-hardening posture without introducing costly additional infrastructure or introducing the operational burden and security risk associated with maintaining and rotating static shared secrets.