Omit top-level sg from VPC launch-options

If an instance is placed in a VPC by providing :network-interfaces
options then the top-level security group name munged from the
pallet group name must not be used, or the AWS API will throw an
Exception.

This commit omits the :security-groups key from launch-options
when the node-spec has a [:provider :pallet-ec2 :network-interfaces]
key.