Include all cache configuration in CDK

[drewbo]

Currently, one portion of the cache configuration (inbound security group rules) is left out of the CDK setup because I was initially worried about circular references. However I think I was unclear about some CDK functionality because it should be possible to include.

• create a security group to be used by the lambda (only needs allowAllOutbound); we need the reference to the lambda security group later and currently there is no method to get this from an automatically generated security group on lambda in VPC creation.
• call the sg.addIngressRule method on the cache security group to add ingress from the lambda function's security group created above

Additional related improvements:

• the two policies that are added to the lambda role have unhelpful names (iam_policy_statement and vpc_access_policy_statement); probably worth coming up with something better for future readers

cc: @leothomas