When no security group is specified in a NodePool, create a default security group so that load balancers can be created/deleted properly in the guest cluster. The following will be true:

1. Only one security group per hostedcluster will be created (associated with the VPC)
2. The security group will be created once and not be reconciled after creation.
3. The security group will be named using the hostedcluster's infra ID ([infra-id]-worker-sg)
4. The security group will be tagged with the k8s tag for the cluster:
   `kubernetes.io/cluster/[infra-id]=owned`
5. The security group will be destroyed when the hostedcluster is deleted.