Add CloudFormation benchmark options

[rgarcia]

Summary

• add optional HTTP/HTTPS ingress parameters for the quickstart security group
• add gp3 IOPS and throughput parameters for the Hypeman data volume
• move root/data block-device mappings into the launch template helper so gp3 throughput and nested virtualization are configured together
• extend CloudFormation template contract tests for the new parameters and launch-template payload

Tests

• go test ./... (deploy/aws/cloudformation)
• git diff --check origin/main...HEAD

---

Note

Medium Risk
Enabling ingress exposes web ports on the instance; defaults stay closed, but mis-set AllowedIngressCidr could widen attack surface when toggles are on.

Overview
Adds optional public ingress to the Hypeman EC2 quickstart stack via new CloudFormation parameters EnableHttpIngress, EnableHttpsIngress, and AllowedIngressCidr (all surfaced under the Network parameter group, defaulting to off with 127.0.0.1/32).

When enabled, HypemanSecurityGroup gains conditional !If rules for TCP 80 and 443 scoped to AllowedIngressCidr, alongside the existing API and SSH rules. The launch-template helper comment is updated to note gp3 throughput as another reason that helper exists.

Contract tests now assert the new parameter defaults, ingress CIDR guidance text, four security-group ingress entries, and a shared assertConditionalIngress helper for the HTTP/HTTPS !If blocks.

^{Reviewed by Cursor Bugbot for commit b928d6f. Bugbot is set up for automated code reviews on this repo. Configure here.}

[firetiger-agent]

Firetiger deploy monitoring skipped

This PR didn't match the auto-monitor filter configured on your GitHub connection:

Any PR that changes the kernel API. Monitor changes to API endpoints (packages/api/cmd/api/) and Temporal workflows (packages/api/lib/temporal) in the kernel repo

Reason: Changes are limited to CloudFormation templates and AWS deployment configuration, not to API endpoints or Temporal workflows.

To monitor this PR anyway, reply with @firetiger monitor this.