remove admins::restricted from lucene role

admins::restricted should just give access
to bastion hosts but not more

can we add a new group for this if there
are people who should have it but are not in
mortals already?

Change-Id: I0013d5fd7e4bb1c249b47bdccffc2923790cae99
Merge "remove admins::restricted from lucene role" into production