Fix matcher output when the args to the matcher are a hash for two resources

[clintoncwolfe]

Fixes #2925

2925 indicated that reporters would output an empty hash when a matcher that accepted hash arguments was used. It turned out that works fine - it's just that two resources, aws_iam_security_group and aws_iam_policy were both using Hash#delete to whitelist criteria in matchers, without duping the Hash. So, if all went well, the input hash would be emptied; and the reporter would faithfully include an empty hash in the test description.

This fix simply adds dup calls to the matcher hash arguments. To test, run the AWS integration tests and observe test output for the two affected resources.

[jquick]

Thanks @clintoncwolfe