Fix bug 817872.
This patch modifies the behavior of removing security groups via the EC2
API to better match the EC2 API spec. The EC2 documentation says that a
group that is still in use can not be removed.
A new function has been added to the db API to find out whether a
particular security group is still in use. "In use" is defined as
applied to an active instance, or applied to another group that has not
been deleted.
Unit tests have been updated to ensure that an error is raised when
these conditions are hit.
Change-Id: I5b3fdf1da213b04084fe266c1a6ed92e01cf1e19
3dc539bcb0