BE - Support adding a flow to a group

We need to add support for adding a flow and third party flows to top-level groups, and create a service account for the flow.

This should only be allowed by the owners of the top-level group.

We should only allow adding a flow to a top-level group.

PoC for the entire feature: !209779