fixed vpc provisioning / clarified group_id usage

I dug into this more and it looks like the intent is for group_id to always be a list at time of use.  The documentation needs to be updated, which is in my attached PR, as well as support for a non-list value for group_id.

This is for #3626 and tested on boto 2.9.8 for both VPC and non-VPC provisioning with and without a list for group_id.