Only run the group cleanup job on Staging

The subgroup cleanup job has a parameter that tells it to run against staging, but the job itself runs in all environments.

This adds a rule to only run the job in staging (which is the only environment in which we currently have admin access)