Limit Group.ParentID edits to ADMIN

This prevents privilege escalation by an authenticated CMS user
with CMS_ACCESS_SecurityAdmin permissions, but no ADMIN permissions.

Also clarified the EDIT_PERMISSIONS description (IP address limits are no longer part of 3.1)