Get security group detail

Retrieves a single security group with its full read model for the security group detail page: identity (id, name, description, createdAt), the complete embedded rules array — each rule exposing direction, ether type, protocol, port range, source/dest CIDR or remote group reference and description — and the attachedPorts count used by the Essentials panel and the "N attached" header metadata. The detail view derives inbound/outbound tab contents by filtering rules on direction; no extra round-trip is needed. Validation: securityGroupId must reference an existing, non-deleted security group inside the scope → 404 NOT_FOUND otherwise; the caller must hold at least reader on the scope → 403. Async & state: Synchronous read; no state change. The detail view subscribes to resource.updated SSE frames for this security group and merges status/rule patches into the cached entity. Errors: 401 unauthenticated; 403 caller has no role on the scope; 404 unknown or soft-deleted security group; 500 on read-model failure. Idempotency/Concurrency: Safe, cacheable; no idempotency key required. The response carries an ETag the UI presents as If-Match on subsequent PATCH/DELETE calls.