[aws/security_group] Support mock of group from another account

It is possible to have a security group rule refer to group that is a
different account, by UserId and GroupId or GroupName. If a GroupName is
not supplied, the security group mocking implementation searches for the
security group that matches the supplied GroupId. This commit allows for
a default GroupName of nil if it is not supplied.