restrict admins from creating or deleting more powerful admins

fixes CNVS-13351

test plan:
 * created an admin role that has permission to create other admins,
   but that's it
 * as an admin in that role, it should only show that role as one
   to choose for new admins
 * you should only be able to delete admins in that role
 * verify both of the above are enforced via the API

Change-Id: I11459567ab184d787ee02af55280e0f4f76d47e8
Reviewed-on: https://gerrit.instructure.com/35672
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Rob Orton <rob@instructure.com>
QA-Review: Jeremy Putnam <jeremyp@instructure.com>
Product-Review: Cody Cutrer <cody@instructure.com>