Change rules for getting rights for groupManager on attributes

 - change rules on member-resource attributes: only rights on any assigned
   group to resource are needed, add comment with definition of this rule
 - change rules on resource-group attributes: add comment with
   definition of this rule
 - change rules on user-facility attributes: groupManager need rights on
   any group (under resources of facility) which is from the same vo
   like some of users member, add comment with definition of this rule
 - change rules on user attributes: only has groupManager in vo where
   user has any member, add comment with definition of
   this rule
 - change rules on member attributes: only has groupManager in vo, where
   the member has membership, add comment with definition of this
   rule
 - change rules on vo attributes: change rights from NEVER to only
   has groupManager in vo, add comment with definition of this
 - do NOT change rules on group, resource, facility and host attributes