(aws-ec2): restrictDefaultSecurityGroup does not remove IPv6 egress rule

### Describe the bug

Setting restrictDefaultSecurityGroup to true for a dual-stack VPC will not remove the IPv6 egress rule.

### Expected Behavior

For a dual-stack VPC with restrictDefaultSecurityGroup set to true, _all_ (IPv4 and IPv6) ingress and egress rules should be removed.

### Current Behavior

For a dual-stack VPC with restrictDefaultSecurityGroup set to true, only IPv4 ingress and egress rules are removed.

### Reproduction Steps

```typescript
import * as cdk from 'aws-cdk-lib';
import * as ec2 from 'aws-cdk-lib/aws-ec2';

const app = new cdk.App();
const stack = new cdk.Stack(app, 'stack');

const vpc = new ec2.Vpc(stack, 'vpc', {
ipAddresses: ec2.IpAddresses.cidr('10.0.0.0/24'),
ipProtocol: ec2.IpProtocol.DUAL_STACK,
restrictDefaultSecurityGroup: true,
});

app.synth();
```

### Possible Solution

_No response_

### Additional Information/Context

_No response_

### CDK CLI Version

2.135.0 (build d46c474)

### Framework Version

_No response_

### Node.js Version

v20.12.0

### OS

macOS Sonoma 14.4.1 (23E224)

### Language

TypeScript

### Language Version

TypeScript (5.4.3)

### Other information

_No response_