Fix bastion security groups

[tayzlor]

We provision bastion with

security_groups   = ["${module.sg-default.security_group_id}", "${aws_security_group.bastion.id}"]

This actual means bastion is connectable on any port (default security group is open). It shouldn't be the case

This isn't actual a problem specific to coreOS - it exists in master as well AFAIK