Non-intuitive behavior for --remove-existing

[erik]

Due to the way the AWS Security Group API works, we're only able to revoke security group rules which match exactly all the keys we pass in.

In the case of existing rules that conflict with what we add, the only thing differing may be the description field, still resulting in the groups failing to be removed.

Given that the flag is --remove-existing, this behavior is unexpected.

See: #22

https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_RevokeSecurityGroupIngress.html