update-EC2-netblocks: pass dry_run, not options.dry_run