(NC-145) Validate hierarchy on group change.

Whenever a new group is created or a group is updated, the subtree of
the hierarchy rooted at the group in question taking into account any
modifications by the request being serviced is validated for missing
classes or class parameters. If any are found, the action is aborted and
a structured error message is sent to the user, with both
a human-readable message and a machine-readable listing of every missing
class and parameter that includes where the error was encountered and
which group originally defined it.

Doesn't have any tests that ensure children are checked when changing
a group's parent.
Add hierarchy validation tests (one still failing).