ECS Fargate Networking: AWSVPC Mode and Security Group Automation

Act as an AWS Network Engineer. Write a highly modular [CDK_LANGUAGE] (TypeScript/Python) script utilizing the AWS CDK to securely provision the fundamental networking layer for an isolated ECS Fargate service operating within [VPC_ID]. The architecture must strictly mandate the `awsvpc` network mode, forcefully deploying all tasks deep into the private, non-routable [SUBNET_IDS]. Automate the programmatic creation of a dedicated Task Security Group engineered with absolute least-privilege: it must only accept ingress traffic on the specific [INGRESS_PORT], and that traffic must be strictly limited to originating solely from the Application Load Balancer's distinct Security Group ID. Conclude with a technical note explaining exactly how Fargate allocates secondary IP addresses from the subnet CIDR blocks, warning against IP exhaustion.