fixes #1646, #3103 - enable cloning for templates, and add read-only options

Host and Host group both use 'view' for clone.  I assume because the permission is evaluated on the original object, and you only need to view that one. 

Although it is confusing to show a clone link if the user ultimately doesn't have create rights.