EC2 policy resources and conditions updated for VPC - EUCA-9936

The supported EC2 resources and conditions for use in IAM policy are
updated for VPC. Non VPC resources and condtions are also updated with
changes since the initial implemenation of this functionality.

EC2 ARNs are updated to allow VPC resources and to allow the use of
account numbers. Type names for key pairs and security groups are
updated to match those used in AWS/EC2 but we will accept the old names
in ARNs for backwards compatibility.

The EC2 (mainly VPC) service is updated to respond with the error code
UnauthorizedOperation on authorization failures.

EUCA-9936