engine,webdmin: Restrict destination host parameter for administrators

Users aren't supposed to be able to provide any host level parameters
to commands.

New action groups added:
- EDIT_ADMIN_VM_PROPERTIES
- EDIT_ADMIN_TEMPLATE_PROPERTIES

The permission check is applied if e.g. destination host is specified
and is different from the default VM destination host
for Run/RunOnce/UpdateVM/UpdateVmTemplate/AddVM/AddVmTemplate VM actions.

The new action groups are assigned to:
- SuperUser, DataCenterAdmin, (ClusterAdmin, TemplateAdmin) roles.

GUI role tree is updated.
Permissions are propagated into REST API layer.

Change-Id: I5294854d24b235f2c50fa7f3d4e7472cf7598b53
Bug-Url: https://bugzilla.redhat.com/902353
Signed-off-by: Libor Spevak <lspevak@redhat.com>