Live security group additions and removals

Problem:
Currently CloudStack requires an instance to be stopped before adding or removing a security group, causing unnecessary downtime. The underlying iptables rules are enforced at the hypervisor level and should not require instance downtime to modify.

Expected behavior:
Security groups can be added or removed from a running instance without a stop/start cycle.

CloudStack version: 4.21.0.0
Zone type: Security Group zone

首先追蹤 CloudStack 對執行中執行個體進行的 security-group 新增/移除操作，以及 hypervisor 層級的 iptables 規則如何套用。比較 Security Group zone 中執行中執行個體與已停止執行個體的行為。完成標準是：新增與移除無需經過 stop/start 週期即可正常運作，同時維持預期的 security-group 強制執行。

由索引模型根據 Issue 內容生成。