AWS: Find the correct security group by looking at tags
AWS: Find the correct security group by looking at tags

Like everything else AWS, we differentiate between k8s-owned security
groups and k8s-not-owned security groups using tags.

When we are setting up the ingress rule for ELBs, pick the security
group that is tagged over any others.

We continue to tolerate a single security group being untagged, but
having multiple security groups without tagging is now an error, as it
leads to undefined behaviour.

We also log at startup if the cluster tag is not defined.

Fix #21986

kubernetes/cloud-provider-aws,kubernetes/cloud-provider-aws,kubernetes/cloud-provider-aws