Set security_groups:update policy to always deny

Changing a security group name is bad for cells sg syncing.

Change-Id: Ie4ed694c2ee904a845a8dbfcff7306797273ba8c