Limit Group.ParentID edits to ADMIN

This prevents privilege escalation by an authenticated CMS user
with CMS_ACCESS_SecurityAdmin permissions, but no ADMIN permissions.