Restrict creation of new properties to new "propertycreator" group and sysops.
The propertycreator group can be added/removed by sysops.

Bug: 46953
Change-Id: I7c2cd4a8316e39129c7d0e0864c4f3493ce69043