Can't create "no access" ec2.SecurityGroupRule

Troposphere is disallowing my ec2.SecurityGroupRule because it doesn't have a valid `FromPort` or `ToPort`.

Cloudformation automatically adds an "all" rule to ingress/egress definitions that are left blank, so if you want to specifically create a rule that disallows access you create a rule against localhost with an IpProtocol of `-1` and no to/from port info.

Despite what the http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-ec2-security-group-rule.html docs say, `FromPort` and `ToPort` are not required when using `IpProtocol=-1` from a VPC.

See this example taken from http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-ec2-security-group.html#d0e39862 :

``` json
"sgwithoutegress": {
"Type": "AWS::EC2::SecurityGroup",
"Properties": {
"GroupDescription": "Limits security group egress traffic",
"SecurityGroupEgress": [
{
"CidrIp": "127.0.0.1/32",
"IpProtocol": "-1"
}
],
"VpcId": { "Ref": "myVPC"}
}
}
```

Start at the ec2.SecurityGroupRule entry point and trace validation for FromPort and ToPort when IpProtocol is -1. Add coverage for the localhost rule shown in the report, and confirm the rule can be serialized without either port.

Written by the indexing model from the issue text.