Add config settings for custom CIDR range on API load balancer

[codyebberson]

https://medplum.slack.com/archives/C04A55B3VU5/p1697127355002999

• When using apiInternetFacing = false in the Medplum CDK config, the API server is only accessible to the VPC
• Users want to allow access to specific IP address ranges to allow access from other internal services
• Or, alternately, a "bring your own security group" feature where you can specify the security group by name or ID
• Exposing "BYOB security group" would be more flexible, and more aligned with "The AWS Way", because you could grant access by service or other security group
• See our API load balancer definition here: https://github.com/medplum/medplum/blob/main/packages/cdk/src/backend.ts#L362
• Note that we currently use the default security group configuration