WFLY-490 / WFLY-2085 / WFLY-2190 RBAC server group scoped role improvements

WFLY-2085 -- hide a master HC with no servers from a server group scoped role (slave HCs with no servers are visible)

WFLY-2190 -- prevent add/remove showing up as allowed for a s-g-s-r's own server group