Make compute_api.trigger_members_refresh() only issue a single db call

This method currently make n db calls equal to the number of security
groups given by group_ids parameter plus n db calls equal to the number
of rules found for those security groups.

This change makes use of a newly created db api call to replace the
many calls issued today to get the list of instances affected by
changes to security groups.

This is also a precursor for making network manager call this directly
instead of going through conductor.

Since this is now converted to use instance objects, convert its call
to compute manager refresh_instance_security_rules() all way down to
handle instance objects as well.

Related to blueprint kilo-objects

Change-Id: Ic7e1a0b7a8f79dfc53adda6b61f54dd1eff78f80
Revert "Make nova-network use conductor for security groups refresh"

This reverts commit b1838c258df2465756e551fdb879b1d4a748cb2b.

This makes network manager issue security group refresh calls directly
instead of going through conductor now that the compute api call is
converted to objects.

Related to blueprint kilo-objects

Change-Id: I74e002384b11063e30450e3854a95b6b848ddfb6
Remove unused db.security_group_rule_get_by_security_group_grantee()

Change-Id: I968cab433f8158e8b1ee1eecb075396cc2d55a07