Check for used & read-only roles & groups in model rather than controller

This fix is:

* moving the logic for checking a role / group in use as well as a read-only role / group from
controller to model
* simplifying the controller code

https://bugzilla.redhat.com/show_bug.cgi?id=1126536