Networking tweaks - move @sjcorbett's security group customizer, and create a new security group definition object

some of this is WIP, usable but far from finished. PRing in case it is useful in future as not likely to work on it further at this point.  marked Beta and if not useful we can remove or improve in time...