Ensure only top level groups associate with organizations

Currently an Organization has_many Groups. This should really be limited to only top level groups. We need to define a set of restrictions to ensure this is always the case.

We will need validation callbacks on both the Organization and Group models.