return vm_id not vm object from create_vm()

Closer to our ‘don't use objects outside transactions’ approach.
Though this function isn't truly like that (its args are objects) and
it's called outside a transaction.
minor: don't show loading… in <audit-display> if loading failed
add an optional default security group to AWS Providers