bug fixes for run list groups

Run list groups are global and were causing trouble by pulling in
roles from other clusters. This commit fixes that with a regression
test and removes some unneeded functionality: adding security groups
at the class level.

Change-Id: I5eacae0a59a061148ca9687f2bc042296c003fd8