Add a new requirement that all new groups *must* have a parent group

Add a new requirement that all new groups must have a parent group. When doing a new multi-org installation, the system should require the admin to create a top-level org/group to represent the multi-org hierarchy root. Then when new groups are created, they default to being children of the "master" group of the multi-site that user is responsible for. The list of other children groups are also presented as options for the required parent group.

This simplifies permissioning and data siloing in multi-org because there will be no orphaned groups. All of them have to fit in somewhere in the hierarchy.