Core: service identity can be group admin

There is no reason why service identities shouldn't be able to get
additional roles in core. Except that we won't be able to get real actor
form audit log for action made by the service identity. That's the risk
that user who give additional role to service identity must take.

This commit only changes behavior of add group admin. Other similar
methods are already accepting service identities.