BE - Prevent adding item consumers to non-top-level groups

We have always allowed creating item consumers for all groups, however, as part of the agent identity stuff, we decided we should change what adding an item to a group means, and restrict it to top-level groups, for the purposes of service account creation.

We should prevent creating non-top-level groups, restrict the creation to owners, and require that the service account is created.