Add validation for namespace on compliance frameworks

What does this MR do and why?

• At the moment, it is possible to create a compliance framework via the GraphQL API associated with a personal namespace. However, if the framework is created it is not usable in any way.
• We would like to add support for personal namespaces at some point, but that support doesn't exist right now.
• This MR adds validation to ensure that the namespace is only a root, group namespace.

How to set up and validate locally

• Create a compliance framework using the createComplianceFramework graphQL mutation on:
  • A root group. (This should work.)
  • A subgroup. (This should resolve to the root ancestor.)
  • A personal namespace. (This should not work.)

MR acceptance checklist

This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.

• I have evaluated the MR acceptance checklist for this MR.

Related to #351739 (closed)