Implement specification of AWS security groups in ingress rules as <owner>/<id>

Necessary for non-VPC cross-account SG rules and the `amazon-elb/amazon-elb-sg` trick.