Sometimes use quantum for SecurityGroup

Sometimes use quantum for SecurityGroup

This implements the following properties in AWS::EC2::SecurityGroup
- VpcId
- SecurityGroupEgress

If VpcId is specified, completely separate code paths
are used which make quantum calls instead of nova calls.

This implements blueprint quantum-security-group

This is based off https://review.openstack.org/#/c/22280/
with a few enhancements:
- Quantum firewall rules translated to acceptable format for ICMP
- remote_ip_prefix used for security group rule creation

Change-Id: I8f1953cb559da0e97821ae0072dfb01dc8267c0c
Signed-off-by: Jeff Peeler <jpeeler@redhat.com>