[security] when checking an rdef `read security groups`, do nothing if they are the default [rejected]