This patch makes it possible to specify GroupID in the options hash to the
aws computre requests operating on security groups. This is needed since
when working with VPC you must use GroupID instead of name.
This moves tag_sets out of individual resources and up to a top-level
item in each mock account's hash. Starting with images, this allows
other mock accounts to create and use their own tags on images they
have launchPermission on.