Switch to using IMDSv2, turn on encryption at rest

[yi2020]

Ran Cloudrail against the TF here with basic parameters and found a couple of issues.

1. module.ecs.module.ecs_instances.aws_launch_configuration.launch is not using IMDSv2 (metadata_options). The issue can be important because traffic to the ECS can be direct, and if there's a web app running there, someone could access the metadata service.

2. The log groups are not encrypted (module.ecs.module.ecs_instances.aws_cloudwatch_log_group) and EBS is not encrypted at rest (for module.ecs.module.ecs_instances.aws_launch_configuration). Generally not a biggie, but if used in certain regulated environments, it can be a lot of "fun" to fix this after the stack is deployed.

I can take on a fixing both issues and opening a PR, please let me know if this is of interest.

[arminc]

It would be interesting to have this, if you can create a fix and add the info to the documentation that would be very much appreciated!