UP-4066
Manage Portlets: Group and category selection use permissions to get forest root

This change provides several necessary fixes for delegated portlet administration.
First, it updaes the 'Select Categories' and 'Select Groups' steps by filtering
the available choices based on the user's permissions.  (In the past, Portlet
Administration users were almost always superusers.)  Secondly -- and also in
furtherance of delegated portlet admin -- this change includes several additional
permissions checks during and at the end of the Portlet Manager publishing wizard.
These check are aimed at preventing a Portlet Manager user who is a non-superuser
from stepping outside the bounds of granted authority.