Fixes #6142, group content accessibility can only be set at group creation time (non-editable property)

This changeset implements the following requirements from @cash's checklist:

* limit the access levels available in restricted groups to group only plus private
* don't allow changing the restricted access setting for a group - it is a one time decision when creating the group