High-level Application Load Balancer builder following AWS security best practices. **Default Security Settings:** - Internet-facing = false (internal by default for security) - HTTP/2 = enabled - Deletion protection = false (can be enabled for production) - Drop invalid headers = true (security best practice) **Rationale:** These defaults follow AWS Well-Architected Framework: - Internal ALBs by default prevent accidental public exposure - HTTP/2 improves performance - Dropping invalid headers prevents header injection attacks **Escape Hatch:** Access the underlying CDK ApplicationLoadBalancer via the `LoadBalancer` property for advanced scenarios not covered by this builder.