use permitted_params for group_controller

make code climate happy

see: https://www.openproject.org/work_packages/3331