Small changes to address feedback

Thanks @h-lame!

- Refactored policy advisory group picker to be more clear
- Changed migration to just a `change` since it was cleanly reversible
- Made foreign key relationship between policy_advisory_groups and
  policies explicit
- Avoided in-memory sorting by deferring it to SQL