Forbid deletion of special groups (users, clients, admins, billing-admins)

[markan]

We currently allow users to delete 'special' groups.

A common example is someone deleting the users group. This horribly breaks user association, and because of the way ACLs are implemented is difficult to recover from since every single object will a require ACL fix to add users back.

We should forbid deletion of those groups. Probably the most straightforward way is to add a whitelist of groups that must not be deleted and check them in oc_chef_wm_named_group:delete_resource function.

[marcparadise]

👍 to this issue/change. Internally we rely on the presence of these groups (in particular admins and users) and make assumptions based on their existence.