Move master :22 allowlist to SSM and drop committed CIDRs

[nogueiraanderson]

Bug

• The master break-glass :22 allowlist lived as committed /32s in this public repo (module default plus psmdb/pmm extras), disclosing operator egress IPs and diverging per master

Fix

• The master-ssh list joins the SSM allowlist as ADR 0036's planned second tenant: empty module default, all 8 master-*.tf consume the SSM-resolved list, fail-closed postcondition (parameter must exist, hold valid CIDRs, never 0.0.0.0/0)
• Seed value is the union of the old baseline and the psmdb/pmm extras, so the two extra CIDRs now get :22 on all 8 masters instead of one each (deliberate widening, called out below)
• The allowlist-set recipe gains master-ssh in its case gate and binds both operands once via quote(), so operator input never evaluates as shell
• Adds prevent_destroy to the LGTM S3 buckets, and the pxc molecule SG gets the same world-open-by-design rationale its ps80 twin already carries

Tickets

• Repo review finding (MED, security): ADR 0036 second tenant