For configuration settings like instance type and security group, I would strongly recommend looking at Cloudformation; as an example of why, imagine that in the future you want (or need) to bump up your instance type. Or maybe you need to make a change to a security group that allows connections between your app and data store. Do you really want to have to deploy application code to do these things? Keeping infrastructure configuration in Cloudformation is in my experience a best practice.
That said, the reason you haven't been able to find a single list of settings is described here: https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/ebextensions.html
The option_settings section of a configuration file defines values for configuration options. Configuration options let you configure your Elastic Beanstalk environment, the AWS resources in it, and the software that runs your application. Configuration files are only one of several ways to set configuration options.
The Resources section lets you further customize the resources in your application's environment, and define additional AWS resources beyond the functionality provided by configuration options. You can add and configure any resources supported by AWS CloudFormation, which Elastic Beanstalk uses to create environments.
The other sections of a configuration file (packages, sources, files, users, groups, commands, container_commands, and services) let you configure the EC2 instances that are launched in your environment. Whenever a server is launched in your environment, Elastic Beanstalk runs the operations defined in these sections to prepare the operating system and storage system for your application.
So there is not a list of all options, they are scattered about like you've found. In general though, from what I recall and this doc, there are three main pieces:
1.) option_settings (eb environment, some resource config)
2.) resources (further resource configuration)
3.) ec2-internal specific settings
I personally only use ebextensions for #3, e.g. an Apache web server config that I need to set on each ec2 instance. Resource/configuration management lives in Cloudformation.