remove release users from admins::restricted

they just need the bastion host(s) but not
terbium/fluorine. and now we have a group for that

original message from Hooman (which is still true) was:

Users in this group only have access to bast1001. From there
they can jump to specific machines which they need access to, but
not to all the hosts admins::restricted have access to (like terbium,
fenari, or fluorine which hold private data).

Change-Id: Ic4695421cc9f95e3fed73a0dc747017c6324bea5