Should IP ACLs be a default requirement for SRA on AWS and out of the customization folder?

[jdbraun-db]

Right now, IP ACLs are in the customization folder of SRA and not a required resource. IP ACLs, or a corresponding front-end mitigation like front-end PrivateLink, is a best practice for Databricks, so I wanted to pose the question of if it should be added by default.

Pros: This follows best practices and adds another layer of security.
Cons: Folks deploying SRA aren't always aware of their IPs when deploying, so it could cause a lockout of the workspace if a VPN IP were to change.

The middle ground is an optional boolean to enable, which as a practice we've been trying to steer away from.