Do not document deprecated options for EC2 sec group commands

As far as I can tell, this is a regression from the previous
versions of the AWS CLI, although this problem has existed for
a while now.

To summarize what's going on, if you look at the reference page
for the EC2 API of AuthorizeSecurityGroupIngress, you'll notice
that the params I've marked as _UNDOCUMENTED in this PR aren't
documented in EC2's docs:

http://docs.aws.amazon.com/AWSEC2/latest/APIReference/ApiReference-query-AuthorizeSecurityGroupIngress.html

The reason for this is that these params have been superceded by
the IpPermissions list, which can handle all the cases of the
deprecated args as well as allowing for specifying multiple
rules in a single call.

Now, for convenience, we added a customization a long time ago that
re-adds these deprecated commands, but internally maps them to the
IpPermissions list.

However, a while back, the customization in botocore that handled
removal of deprecated params was changed such that these arguments
were being surfaced again.  This made it confusing for customers
because there's now similar args:

* ``--cidr-ip`` vs ``--cidr``
* ``--ip-protocol`` vs. ``--protocol``
* etc.

and they are actually mutually exclusive.

This PR adds back that old behavior by not documenting the
deprecated params and also adds a unit test to verify these
don't show up in our documentation again.

This should make things much more clear for customers.


This also includes some cleanup to the unit tests and switches them
over to assert_params_for_cmd2, as well as cleans up the pep8
formatting of the tests.

cc @kyleknap @danielgtaylor