'create-security-group' expects an array of rules

We had implemented it so that you could provide the flag multiple times,
but it seems that just having one blob of JSON might be simpler.

[Finishes #73494074]