fix: security groups merge resolve more appropriately

Previously, it was easy to clobber security group authorizations when
merging Ironfan objects. This commit makes it a bit less easy and
introduces some regression tests. It also documents some desirable
changes with pending tests.

Change-Id: Icd6172917c0e4b730a92762790a4b49efbbd80c7