Proper attribute merging

this fixes the current prod bug where roles cannot override the security group settings they inherit from a common role. 

another, more complicated problem remains. we support two keys for instance metadata, the legacy `stemcell` and the more new `instance_metadata`. what happens if a role has both defined?

currently, the behavior is unspecified. the recommendation is to stick to using one of those consistently throughout. we should probably deprecate one of those two...

@nelgau @jtai