Add cscott to admin::restricted

It's not all that useful to be allowe to a host but not
to bastions to reach that host.  :-)

Change-Id: Ie8d21b95e88a1bcca264abc8d74c9339887bc6c2
RT: 6655