JcloudsLocation: allow disabling of opening IP Tables

- If not WAIT_FOR_SSHABLE then don't try to mapSecurityGroupRuleToIpTables.
  With private subnets, this fails because the IP that jclouds knows about isn't visible.
  Subsequent code in brooklyn can set up port-forwarding to make it usable, but this code blocked waiting and then failed.

TODO: Controversial? Is there a better way of doing this?