Consolidate how we handle SGs

[gregharvey]

We should check through all ce-provision AWS roles that require lists of security groups and:

• where they currently pass names to a module, check if the module supports IDs and switch over
• centralise looking up SG IDs from a list of names, as we do here, in the EFS role

That way we have consistency because:

• we are always passing SG IDs, not names, to Ansible; and
• we allow users to pass a list of SG names anyway