BZ# 1128282 - Remove descendant hostgroups from the foreman host form

Users should not assign hosts directly to the deployment hostgroups.
This removes those choices from the host edit form.
Also, extends the foreman API to disallow setting the hostgroup via the API
I wonder if the UI controller needs the extensions too. UI-centric fixes (hiding the options) are the first line of defense, but unless the controller enforces it too, an admin with a shell script and curl can get around it.