Or, alternatively, is it possible to append rules to an existing security group?

I think in the docs it says you can't append SecurityGroupIngressRule if you specify ingress in the SecurityGroup

You can do it if you don't use the built-in block, just use SecurityGroupRules. Pulumi creates the group before the rule, so the rule's id is available at that point. No idea if it would handle a self-referential rule, but it seems likely?