Rewrite get_secgroup_uuids to avoid resource_by_refid

get_secgroup_uuids has changed in the following ways:
* No longer attempts to find a security group name via
  a resource_by_refid lookup. resource_by_refid only exists
  as a workaround for AWS compatibility resource which are
  not backed by an API. Usage of resource_by_refid should be
  avoided in native resources if at all possible.
* If the security group looks like a UUID, assume it is
  a UUID for a security group that exists
* Call client.list_security_groups only once, and only if
  there is a non-uuid security group specified
* Do not attempt to reduce duplicate security groups to a unique
  list. If that is important for resources it can be done in
  validation.
* Raise PhysicalResourceNotFound if name maps to no group
* Raise PhysicalResourceNameAmbiguity if name maps to more than one
  group

Change-Id: I106adc15a7882192884d37c0806947470d139434
Closes-Bug: #1250286
Move resource doc generation to doc/source/ext

This is similar to other projects, and removes this
code from the withering gaze of coverage reports.

Change-Id: Ie0acb2a203f2e69a7d84aba3915a8499ab51ecb6
Merge "Move resource doc generation to doc/source/ext"
Merge "Rewrite get_secgroup_uuids to avoid resource_by_refid"