canonicalise security group rules

This is related to a suggestion in #87. It stops terraform from thinking there have been changes just because Amazon messes with the grouping and ordering of rules.