Refactor db.security_group_get() instance join behavior

Currently, security_group['instances'] is always joined when we
do a db.security_group_get(). This patch adds the growingly-
conventional columns_to_join argument to the call, allowing
us to selectively choose when we want to make this expensive
join operation.

Related to unified-object-model

Change-Id: I1945365c8cf03c027fd143f677cbd6d63a7f8122
Merge "Refactor db.security_group_get() instance join behavior"