Just a heads up that var.additional_security_group_ids is not being used by the aws_network_interface resource.
A visible fix is to point security_groups = [aws_security_group.main.id] to security_groups = local.security_groups
Great work with the module!