switch security group rules back to security group references

[bengerman13]

We should switch all the security group rules using cidrs back to using security group names.
We switched to cidrs to allow cross-region access, but if/when we do another cross-region foundation, we should start with concourse and monitoring in the new region(s)