Update validation for master instance groups

We need update validation for updates to the instance groups, in particular the master instance groups. The following should probably not be allowed:

* Changing the role
* Changing the count of instances (?)
* Changing the zones for the IG

(While we're here, we might as well also validate that the cluster etcd clusters aren't resized)

The issue targets validation for instance-group updates and resizing of cluster etcd groups, but names no files or tests. Start by locating those validation entry points and existing coverage; confirm which role, instance-count, zone, and etcd-size changes must be rejected, then add coverage showing the intended update rules.

Written by the indexing model from the issue text.