Live security group additions and removals

Problem:
Currently CloudStack requires an instance to be stopped before adding or removing a security group, causing unnecessary downtime. The underlying iptables rules are enforced at the hypervisor level and should not require instance downtime to modify.

Expected behavior:
Security groups can be added or removed from a running instance without a stop/start cycle.

CloudStack version: 4.21.0.0
Zone type: Security Group zone

Start by tracing CloudStack's security-group add/remove operation for a running instance and how hypervisor-level iptables rules are applied. Compare the behavior for running and stopped instances in a Security Group zone. Done means additions and removals work without a stop/start cycle while preserving the expected security-group enforcement.

Written by the indexing model from the issue text.