fix(cloudformation-diff): security group rule diff ignores which group a rule belongs to

[Adityaj0]

Closes #1871

Reason for this change

SecurityGroupRule.equal() compares ipProtocol, fromPort, toPort, and peer, but not groupId. This method is used to match rules between the old and new template when computing ingress/egress diffs.

As a result, a rule that moves from one security group to a different one — while keeping the same protocol/port/peer — is treated as unchanged, and the diff silently drops both the removal from the old group and the addition to the new group. This can mask a real permission change (e.g. widening which resource has a given network rule) from cdk diff output.

Description of changes

Add groupId to the equality comparison in SecurityGroupRule.equal(), so a rule moving between groups is correctly reported as a removal + addition.

Description of how you validated changes

Added a test (detect a rule moving from one security group to a different one) that moves an identical-shaped ingress rule from WebSG to DbSG and asserts the diff reports it as a removal from WebSG and an addition to DbSG.

PASS test/network/detect-changes.test.ts
  ✓ detect addition of all types of rules
  ✓ detect a rule moving from one security group to a different one

Checklist

• My code adheres to the CONTRIBUTING GUIDE and DESIGN GUIDELINES

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 91.10%. Comparing base (a4c0282) to head (0473a63).
⚠️ Report is 8 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1872      +/-   ##
==========================================
+ Coverage   90.90%   91.10%   +0.19%     
==========================================
  Files          80       80              
  Lines       12250    12205      -45     
  Branches     1754     1742      -12     
==========================================
- Hits        11136    11119      -17     
+ Misses       1077     1050      -27     
+ Partials       37       36       -1     

Flag	Coverage Δ
suite.unit	91.10% <ø> (+0.19%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.