Updates to operation mode, SGs, cluster type, and additional flags.

[JDBraun]

This PR addresses the following issues:

• [AWS] Remove Egress SG Rules for PrivateLink Endpoints #56: The egress rules for the PrivateLink endpoints have been removed.
• [AWS] AWS VPC Endpoints - Wrong Security Group #55: The VPC endpoints now have been updated to use the PrivateLink endpoint
• [AWS] FIX #50 broke Example Cluster creation #53: The cluster example has been updated to explicitly call out the User Isolation Mode in the data security mode. This can be updated based on user configuration, information here.
• [AWS] Update "Standard" to "Sandbox" as a deployment method #52: The README and the associated variables have been updated to reflect 'Sandbox' instead of 'Standard'.
• [AWS] 8443-8451 need to be added for PrivateLink SGs #51: 8443-8451 have been updated to be added to PrivateLink endpoints.

New Additions:

• A compliance_security_profile flag has been added. If this is set to true, it adds an egress 2443 rule to the data plane security group and an inbound 2443 rule on the PrivateLink endpoint. Since this is only relevant for ESC. 2443 has subsequently been removed from the list of ports in the example.
• A enable_admin_configs has been added. Unfortunately, due to the evolving nature of this API, it has caused issues in certain provider versions. So, this has been defaulted to false. Examples admin configurations, that follow our best practices, have been added in the resource with their documentation, a user should evaluate if they would like to enable this or not.

[JDBraun]

@metrocavich - mind taking a look on the nitro update?

[metrocavich]

All looks good to me now. (And I really looked for something else to comment on...)

[ryan-gord-db]

Looks like AWS advises against using a aws_security_group_rule with an aws_security_group that contains inline rules like the sg resource above. One way to work around the issue is to remove the aws_security_group_rule and add another dynamic block to sg where the for_each is something like this: for_each = [for x in [var.compliance_security_profile ? 2443 : null]: x]. It isn't the most aesthetically pleasing since TF isn't great with conditional logic. Maybe always including a rule to port 2443 outweighs adding this type of logic?

[JDBraun]

good call - let me explore this

[JDBraun]

@db-wenxin + @ryan-gord-db - check out the changes to the SG rules in network.tf I added dynamic rules in the existing block now

[ryan-gord-db]

LGTM