default Security rule doesn't apply to system VMs since nic.getIsolationUri is not set

use to.setSecurityGroupEnabled to indicate if securitygroup is enabled on this NIC

CLOUDSTACK-983: default Security rule doesn't apply to system VMs
We need to catch PermissionDeniedException in checking if command is
available to an user.