An update for the dynamic criteria tags is done by comparing
the old and the new. The problem is that the provider security
groups are part of the security groups and need to be removed
from the normal security groups.
This would result in the port to be updated but the tags not
correctly set on the NSX.
Change-Id: Ia100eb7e546124ca588b1306db63ae6f24d39e9f