provider/aws: updated the security_group attribute to use a set

This way the order returned by the API has no impact on the saved state, preventing false positives when diffing.