Handle security group rules better

Configs will need to be changed from:

```yml
-
  :zone: SSH to private subnet
  :port_range: 22
  :ip_ranges:
  -
    :group_id: sg-12345678 # load-balancers
```

to:

```yml
-
  :zone: SSH to private subnet
  :port_range: 22
  :groups:
  - sg-12345678 # load-balancers
```