IApplicationListener: Bad implicit modifications on security groups

### Describe the bug

I have a setup where there is an existing ALB, Target group and ASG of EC2 instances which is all manually managed. I have a new fargate cluster that is being managed by cdk that I want to attach to the existing ALB so i can share the domain name setup against that ALB but only for a path.

The code for adding the extra rule to the listener along with the fargate task looks like:
```typescript
const vpc = EC2.Vpc.fromLookup(this, 'VPC', { vpcId: props.vpcId });
const cluster = new ECS.Cluster(this, 'Cluster', { vpc });
const appSecurityGroup = new EC2.SecurityGroup(this, this.getName('AppSG'), { vpc, allowAllOutbound: true });
appSecurityGroup.addIngressRule(EC2.Peer.anyIpv4(), EC2.Port.tcp(3000));

const lbListener = ApplicationListener.fromLookup(this, 'LBListener', {
listenerPort: 443,
loadBalancerTags: { 'foo': 'bar' },
});

const taskDefinition = new ECS.FargateTaskDefinition(this, 'TaskDefinition', {
cpu: 256,
memoryLimitMiB: 512,
});
taskDefinition.addContainer('Container', {
logging: new ECS.AwsLogDriver({ streamPrefix: 'Container' }),
image: ECS.ContainerImage.fromDockerImageAsset(imageAsset),
portMappings: [{ containerPort: 3000 }],
environment: ...,
})

const service = new ECS.FargateService(this, 'Service', {
cluster,
taskDefinition,
securityGroups: [appSecurityGroup],
assignPublicIp: true
});

const targetGroup = new ApplicationTargetGroup(this, 'TargetGroup', {
vpc,
port: 3000,
protocol: ApplicationProtocol.HTTP,
targetType: TargetType.IP,
targets: [service],
healthCheck: { path: '/health' }
});

lbListener.addAction('Action', {
action: ListenerAction.forward([targetGroup]),
priority: 1,
conditions: [ListenerCondition.pathPatterns(['/rest/*'])],
})
```

The problem is cdk is deciding to change a security group not explicitly linked here, a security group that was applied to both the ec2 instance and ALB and it changes the outbound rules from allow all ipv4 to only allow port 3000 tcp, breaking the routing between the ALB and EC2 instances.

### Expected Behavior

CDK shouldn't be changing security groups that haven't been linked to or provide a way to remove the connection so that it is not applied to security groups not managed by cdk.

### Current Behavior

`cdk deploy` requests to change a security group it is not managing:

```Security Group Changes
┌───┬────────────────────────┬─────┬────────────┬────────────────────────┐
│ │ Group │ Dir │ Protocol │ Peer │
├───┼────────────────────────┼─────┼────────────┼────────────────────────┤
│ + │ ${AppSG.GroupId} │ In │ TCP 3000 │ Everyone (IPv4) │
│ + │ ${AppSG.GroupId} │ In │ TCP 3000 │ sg-08xxxxxxxxxxxxx25 │
│ + │ ${AppSG.GroupId} │ Out │ Everything │ Everyone (IPv4) │
├───┼────────────────────────┼─────┼────────────┼────────────────────────┤
│ + │ sg-08xxxxxxxxxxxxx25 │ Out │ TCP 3000 │ ${AppSG.GroupId} │
└───┴────────────────────────┴─────┴────────────┴────────────────────────┘
```

### Reproduction Steps

1. Create an ALB and attach to a target group
2. Add the tag `foo`=`bar` to the ALB
3. Run the cdk code above within a stack on the same account

### Possible Solution

Allow an option in `IApplicationListener` to prevent implicitly creating connections to existing resources that must be modified by `cdk`.

### Additional Information/Context

A workaround i have implemented but still don't understand how it works, is that i have created new security groups from the ones used by the ALB and EC2 instances, attached them and now cdk only modifies the original security group even though I can't find it being used anywhere under Network Interfaces.

### CDK CLI Version

2.75.1

### Framework Version

_No response_

### Node.js Version

16.14.0

### OS

Linux/Manjaro

### Language

Typescript

### Language Version

Typescript 5.0.4

### Other information

The output relating to the erroneous SG outbound rule from `cdk synth` output:
```
AppSGfromLBListenerSecurityGroupsg08xxxxxxxxxxxxx251B698D9E300061C0107E:
Type: AWS::EC2::SecurityGroupIngress
Properties:
IpProtocol: tcp
Description: Load balancer to target
FromPort: 3000
GroupId:
Fn::GetAtt:
- ubapiAppSGB1423E6C
- GroupId
SourceSecurityGroupId: sg-08xxxxxxxxxxxxx25
ToPort: 3000
Metadata:
aws:cdk:path: staging/ubapi-AppSG/from LBListenerSecurityGroupsg08xxxxxxxxxxxxx251B698D9E:3000
```

Start with the IApplicationListener and ApplicationListener.fromLookup entry points used in the reproduction, then inspect the cdk synth output for the generated AppSGfromLBListenerSecurityGroups rule. Reproduce the deployment with the existing ALB and security group, and verify that adding the listener action does not create an unintended security-group modification or break existing ALB-to-EC2 routing.

Written by the indexing model from the issue text.