Live security group additions and removals

Problem:
Currently CloudStack requires an instance to be stopped before adding or removing a security group, causing unnecessary downtime. The underlying iptables rules are enforced at the hypervisor level and should not require instance downtime to modify.

Expected behavior:
Security groups can be added or removed from a running instance without a stop/start cycle.

CloudStack version: 4.21.0.0
Zone type: Security Group zone

首先跟踪 CloudStack 对运行中实例执行的 security-group 添加/移除操作，以及 hypervisor 级别的 iptables 规则是如何应用的。比较 Security Group zone 中运行中实例和已停止实例的行为。完成标准是：添加和移除无需经过 stop/start 周期即可正常工作，同时保持预期的 security-group 强制执行。

由索引模型根据 Issue 内容生成。