Allow for changing of security group of RDS in VPC

The code used to rely on the "subnet" argument
being set to determine if this instance was within
a VPC and switch the security group parameter from
secutiry_groups to vpc_security_groups. This works
fine for the command=create case.

However in the command=modify case, the "subnet"
argument is considered invalid (As the AWS API
does not allow for subnet modification of a
provisioned instance). This results in the
security_groups parameter always being treated as
a non-VPC security group, even when it is.

The underlying boto library uses two separate
arguments for when the security group is part of a
vpc (vpc_security_groups) and for when it is not
(security_groups). I feel replicating this
 separation is probably the simplest and most
explicit way of solving this issue.

This pull request implements the separation.