[bugfix] AWS VPC security group membership fix.

* facts now provides a list of existing vpc security group memberships
* adding a comma separated list of sg-* tags properly modifies membership (previously: threw an exception)

boto has been using this modified interface since I believe version 2.12.0.