New db api method instance_get_all_by_grantee_security_groups()

In order to reduce the number of db calls made during security group
rules refresh, introduce a new db api method that with a single db call
accomplishes what currently needs n db calls equal to the number of
security_groups of an instance plus n db calls equal to the number of
rules found for those security groups.

A follow up patch will make use of this in trigger_members_refresh()
in the compute api.

Related to blueprint icehouse-objects.

Change-Id: I8370ccb71c871f169f8235a9d188aac059573880
Add new instance object method get_by_grantee_security_groups()

Add a new method for db.instance_get_all_by_grantee_security_groups().

A follow up patch will make use of this in trigger_memers_refresh()
in the compute api.

Related to blueprint icehouse-objects.

Change-Id: I23152032c01f8cde9100c061efdb4f328abdd16b
Make compute manager refresh_instance_security_rules take objects

Change compute manager method and related calls in compute api to take
instance objects.

Related to blueprint icehouse-objects.

Change-Id: Ic7e1a0b7a8f79dfc53adda6b61f54dd1eff78f80