Move security_groups refreshes to conductor

This moves the last bit of compute-initiated db accesses found during
test runs to conductor. The quantum API was hitting the database directly
while calling back to compute's API to trigger the refresh. This just
makes the quantum API ask conductor to do that in a similar way to the
usage notifications patch recently merged.

Related to blueprint no-db-compute

Change-Id: I44de7e1e12aec291b8319d45ec5975ad05b8e676
Merge "Move security_groups refreshes to conductor"