Have EFS module manage mount_target

[mjmaurer]

A single mount target can be created per AZ, and we do single-AZ EFS. So we should make EFS module manage the mount target and expose the security group (and likely subnet?) for the mount target instead