add permissions on sub-group creation

Users could add subgroups to groups they did not belong
This feature adds permissions to the creation of a subgroup to protect against this.