Prevent Portfolio Admins trying to change their own roles in a group as they can’t change it anyway

[rvowles]

When a portfolio admin tries to edit their roles in environments, they should be shown them all as being ticked and should not be able to edit them. Any changes will be ignored as portfolio admins always have all access to all environments.

[IrinaSouth]

Also, if a group has only one permission Create/Edit/Delete - they should have "read" permission also included by deafult.

[rvowles]

to future me: The effect of having a Create Feature permission but no access to even read in any environment means they cannot even see the application. We should realistically deny them the ability to allow a group the ability to create features that have no permission to even read any environment. We should ensure this stays enforced so they can't update the group to deny access to all environments yet still have create and/or edit feature permissions.