Switch to m1.medium where possible

It seems to have lower demand than m3.medium.  We can't switch
fbsd10-amd64 because it's not a paravirt image.
Fix EC2 spot request leak with holding states