Create a security group

Provisions a new security group in the active scope from the security group creation form submission (entered via the list view's "Add" / "Create security group" button). Visible inputs are the group name, an optional description, a set of common-service ingress presets (SSH and HTTPS pre-selected; HTTP, MySQL, PostgreSQL, RDP and DNS available), zero or more custom rule rows (direction, protocol, port, source CIDR) and cost tags. Each selected preset is expanded server-side into a concrete ingress rule (e.g. SSH → tcp 22/22 from 0.0.0.0/0); a default allow-all egress rule is attached. On acceptance the group becomes discoverable in the scoped list with attachedPorts: 0. Validation: name must match ^[a-z0-9-]{1,63}$ (lowercase letters, numbers, hyphens) → 422 VALIDATION_FAILED on format violation, 409 CONFLICT on duplicate name in the project; every commonServices entry must be a known preset label → 422; each custom rule row needs a valid protocol and, for tcp/udp, a parsable port → 422; source must be valid CIDR notation → 422; the per-subscription security-group quota must not be exhausted → 409 QUOTA_EXCEEDED. Async & state: Asynchronous — returns 202 with an Operation handle. The group is created in a provisioning state and reaches the terminal state ACTIVE; resource.updated SSE frames are emitted for the security-group resource (rule materialization patches) plus operation.updated frames for the returned operation. Errors: 401 unauthenticated; 403 caller lacks contributor rights on the scope; 409 QUOTA_EXCEEDED when the security-group quota is exhausted (duplicate name → 409 CONFLICT); 422 on any field validation failure; 500 on provisioning workflow errors. Idempotency/Concurrency: Idempotency-Key is required; replaying the same key returns the original 202 Operation without creating a duplicate group.