Allow empty EC2 Security Group rules.

Previously, there was no way to force "no egress rules" on a security group short of specifying a phony group. (e.g. "only access localhost"). This was counter to intuition about what `purge_egress_rules` etc. did.

This allows you to set up a rule like:
```yaml
- name: Set up security group for package clients
  local_action:
    module: ec2_group
    name: 'package-client'
    description: Can retrieve packages from package servers
    vpc_id: '{{vpc_res.vpc.id}}'
    region: '{{vpc_res.vpc.region}}'
    rules: []
    rules_egress:
      - proto: tcp
        from_port: 80
        to_port: 80
        group_name: 'package-server'
        group_desc: Build server and apt repository security group
      - proto: tcp
        from_port: 443
        to_port: 443
        group_name: 'package-server'
```

Which will create a security group with *only* the rules specified.