ECS: Service should autoconfigure security groups when attached to NLB

Right now in ELBv2, security groups are configured for Application Load Balancers, but not for Network Load Balancers.

It seems to be that NLBs don't have security groups themselves (verify), but in that case the target should be autoconfiguring its own SGs correctly upon the LB being attached to them.

@karlpatr has sensible things to say about this in https://github.com/aws/aws-cdk/issues/3667, we should investigate and follow up.

Start by tracing the ELBv2 and ECS service attachment entry points and verifying the issue's assumption that Network Load Balancers do not have security groups. Review the discussion in aws-cdk issue 3667, then identify the existing Application Load Balancer security-group behavior and determine the expected configuration when an NLB is attached. Done means the intended behavior is confirmed and covered by relevant tests, though this issue names no files or tests.

Written by the indexing model from the issue text.