Only allow editing of CycleTaskGroupObjectTask assignee for certain roles

Those roles are:
admin;
WorkflowOwner; or
WorkflowAssignee.

The last of those is not a real role in GGRC at the moment.  It's a combination of checking if the user is a WorkflowMember *and* a contact for at least one TaskGroup or TaskGroupTask in the Workflow.