Fixes #6142, adds update operation for group content when changing group content accessibility from 'unrestricted' to 'group only'

This changeset implements the following requirements from @cash's checklist:

* limit the access levels available in restricted groups to group only plus private

The options for changing the restricted access setting for a group include:
* don't change old content - make that explicit in the help text
* rewrite all the old access information for group content when becoming more restrictive but not the other way

Note: group administrators, when changing content access settings, can decide (via a checkbox) if they'd like to update the access level of existing group content, or leave previous content as they are.