Restrict source cloud client to tenant for migrating security groups