Allow customization of default egress security group rules in CAPO managedSecurityGroups

/kind feature

**Describe the solution you'd like**

Currently, when Cluster API Provider OpenStack (CAPO) creates security group rules, it defines default egress rules that allows all outbound traffic (0.0.0.0/0). This behavior is implemented here:

https://github.com/kubernetes-sigs/cluster-api-provider-openstack/blob/a6f9102a5deafe32ec0f237d38dad301cd2df306/pkg/cloud/services/networking/securitygroups_rules.go#L32-L51

In some environments, this default behavior is too permissive and does not comply with security or business constraints that require restricting outbound traffic to specific CIDRs.

I would like to have a way to customize or restrict the default egress rules generated by CAPO without having to disable `managedSecurityGroups`, since this feature provides other valuable functionality that I want to keep (such as automated lifecycle management of security groups).

A possible solution could be one of the following:

- Allow configuring egress CIDR ranges via OpenStackCluster spec
- Provide a flag to disable the default "allow all egress" rule so that I can add only allowed egress ranges via `OpenStackCluster.spec.managedSecurityGroups.allNodesSecurityGroupRules`

The goal is to support environments where outbound traffic must be explicitly restricted without losing the benefits of managed security groups.

**Anything else you would like to add:**

This limitation makes it difficult to adopt CAPO in environments with strict network segmentation requirements (e.g., regulated industries or zero-trust networks), where unrestricted egress is not allowed even temporarily.

A configurable approach would significantly improve the provider’s flexibility and enterprise readiness.

Start with pkg/cloud/services/networking/securitygroups_rules.go at the referenced default-rule implementation, then inspect OpenStackCluster.spec.managedSecurityGroups and allNodesSecurityGroupRules. Define how configurable or disabled default egress should interact with managed security groups, and consider the feature done when restricted CIDRs can be used without disabling lifecycle management.

Written by the indexing model from the issue text.