Restrict NACL rules for backend VPC

[dlpzx]

Current VPC deployed by data.all defines inbound and outbound rules open to all traffic.
What we would like is to have the rules defined as restrictive as possible, allowing only the needed traffic.

[dlpzx]

After testing the solution, I was able to confirm that data.all works correctly with the following NACL rules:

In addition we need to modify STS boto3 calls because for global VPC endpoints without the region it is not possible to resolve it (related to #144)

            sts = base_session.client(
                'sts',
                config=Config(user_agent_extra=f'{__pkg_name__}/{__version__}'),
                region_name=region,
                endpoint_url=f"https://sts.{region}.amazonaws.com"
            )

[noah-paige]

Implemented as part of v1.6