aws-cdk-lib.aws-rds.DatabaseCluster: Unable to add security group to RDS cluster

### Describe the bug

I wanna add a security group to all instances within the RDS cluster that created with the CDK.
It seems to be similar to #17684.

I tried to write the code below by TypeScript.

```
import { SecurityGroup } from 'aws-cdk-lib/aws-ec2';
import ( DatabaseCluster } from 'aws-cdk-lib/aws-rds';

const cluster = new DatabaseCluster(...);
const newSg = new SecurityGroup(...);
cluster.connections.addSecurityGroup(newSg);
```

The RDS instances within the cluster didn't have newSg.

In addition, I tried to get each instances within the cluster to let each have security group. But, It seems that DatabaseCluster class don't have a method to get instances. Is there a good way to add security groups to the RDS cluster later?

### Expected Behavior

The RDS cluster (named `cluster` by above example) can add a security group (named `newSG` by above example) to instances.

### Current Behavior

The RDS cluster (named `cluster` by above example) can't add a security group (named `newSG` by above example) to instances.

### Reproduction Steps

Install CDK

```
npm install aws-cdk-lib@2.81.0 aws-cdk@2.81.0
```

Create the app

```
mkdir additional-sg
cd additional-sg
../node_modules/.bin/cdk init app --language typescript
```

Copy and Paste below code to `lib/additional-sg-stack.ts`

```
import * as cdk from 'aws-cdk-lib';
import {
InstanceClass,
InstanceSize,
InstanceType,
SecurityGroup,
SubnetType,
Vpc,
} from 'aws-cdk-lib/aws-ec2';
import {
AuroraMysqlEngineVersion,
Credentials,
DatabaseCluster,
DatabaseClusterEngine,
} from 'aws-cdk-lib/aws-rds';

export class AdditionalSgStack extends cdk.Stack {
constructor(scope: cdk.App, id: string, props?: cdk.StackProps) {
super(scope, id, props);

const vpc = new Vpc(this, 'adsg-vpc', {
cidr: '10.90.0.0/16',
maxAzs: 2,
subnetConfiguration: [
{
cidrMask: 24,
name: 'adsg-public',
subnetType: SubnetType.PUBLIC,
},
{
cidrMask: 24,
name: 'adsg-private',
subnetType: SubnetType.PRIVATE_WITH_EGRESS,
},
],
});

const sg = new SecurityGroup(this, 'adsg-security-group', {
vpc: vpc,
allowAllOutbound: true,
securityGroupName: 'adsg-sg',
});

const cluster = new DatabaseCluster(this, 'adsg-database-cluster', {
engine: DatabaseClusterEngine.auroraMysql({
version: AuroraMysqlEngineVersion.VER_3_02_1,
}),
credentials: Credentials.fromPassword(
'you',
cdk.SecretValue.unsafePlainText('yourpassword'),
),
instances: 1,
instanceProps: {
instanceType: InstanceType.of(InstanceClass.T3, InstanceSize.MEDIUM),
vpc: vpc,
securityGroups: [sg],
},
defaultDatabaseName: 'adsgdb',
});

const newSg = new SecurityGroup(this, 'adsg-new-security-group', {
vpc: vpc,
securityGroupName: 'new-adsg-sg',
});

cluster.connections.addSecurityGroup(newSg);
}
}

const app = new cdk.App();
new AdditionalSgStack(app, 'AdditionalSgStack');
app.synth();
```

Bootstrap

```
../node_modules/.bin/cdk bootstrap bootstrap aws://YOUR-ACCOUNT-NUMBER/REGION --profile YOUR-AWS-PROFILE --qualifier sandbox999
```

Add below `@aws-cdk/core:bootstrapQualifier` context to `cdk.json`.

```
{
...
"context": {
...
"@aws-cdk/core:bootstrapQualifier": "sandbox999"
...
}
...
}
```

Deploy the stack

```
../node_modules/.bin/cdk deploy --profile YOUR-AWS-PROFILE
```

You can see that the RDS instance containing the name `adsgdb` has just security group named `adsg-sg`. But, I expect the RDS instance to have two security groups.(`adsg-sg` and `new-adsg-sg`)

### Possible Solution

_No response_

### Additional Information/Context

_No response_

### CDK CLI Version

2.81.0

### Framework Version

_No response_

### Node.js Version

v18.11.0

### OS

macOS 13.4

### Language

Typescript

### Language Version

TypeScript (5.0.4)

### Other information

_No response_

Start with the reproduction in lib/additional-sg-stack.ts, focusing on instanceProps.securityGroups and cluster.connections.addSecurityGroup. Run cdk synth or deploy with the provided CDK 2.81.0 example and compare the generated or deployed RDS instance security groups. Done means the requested additional group is applied to the cluster instances, or the supported limitation and workaround are documented.

Written by the indexing model from the issue text.