anchor.diff:  define one ASG for app and task staging, and another for app and task runtime.
   
   To provide granular control when securing a deployment, an administrator can
  -assign ASGs to apply to all containers across a deployment, or to specific
  -spaces within a deployment.
  +assign ASGs to apply to all app and task instances for the entire deployment,
  +or assign ASGs to spaces to apply only to apps and tasks in a particular space.
   
   ASGs can be complicated to configure correctly, especially when the specific IP
   addresses listed in a group change.
  
positive.code: 
  <p class='note'><strong>Note</strong>: Binding an ASG does not affect started apps until you restart them. To restart all of the apps in an org or a space, use the <a href="https://github.com/cloudfoundry-incubator/app-restarter">app-restarter</a> cf CLI plugin.</p>
  
  To apply an ASG to containers, you must first bind it to an ASG set.
  
  + To bind an ASG to the platform-wide staging ASG set, run the following command:
  <pre>
  
negative.code: 
  Application Security Groups (ASGs) are a collections of egress rules that
  specify the protocols, ports, and IP address ranges where app or task
  instances send traffic.
  Because ASGs define *allow* rules, their order of evaluation is unimportant
  when multiple ASGs apply to the same space or deployment.
  The platform sets up rules to filter and log outbound network traffic from app and task instances.
  ASGs apply to both buildpack-based and Docker-based apps and tasks.
  
  When apps or tasks begin staging, they need traffic rules permissive enough to
  allow them to pull resources from the network.
  