Allow for changing of security group of RDS in VPC

The code used to relies on the "subnet" argument 
being set to determine if this instance is within
a VPC and switch the security group parameter from
secutiry_groups to vpc_security_groups. This works
fine for the command=create case.

However in the command=modify case, the "subnet"
argument is considered invalid (As the AWS API 
does not allow for subnet modification of a 
provisioned instance). This results in the 
security_groups parameter always being treated as 
a non-VPC security group, even when it is.

The underlying boto library uses two separate 
arguments for when the security group is part of a 
vpc (vpc_security_groups) and for when it is not
(security_groups). I feel replicating this
 separation is probably the simplest and most 
explicit way of solving this issue. 

This pull request implements the separation.