BZ# 1128282 - Remove descendant hostgroups from the foreman host form

Users should not assign hosts directly to the deployment hostgroups.
This removes those choices from the host edit form.
Also, extends the foreman API to disallow setting the hostgroup via the API
Hmm. I wonder if this would prevent someone from creating an out-of-a-deployment hostgroup that inherits from base (for provisioning to work) and then assigning hosts there. Do we need to verify that this hostgroup belongs to a particular deployment instead?