add repos.revoke_group and repos.grant_group actions

These are a bit hackish (should really be repos.group-privileges.grant/revoke?), but they do work.