Ability to Restrict Groups from Project Roles

Project admins are able to add users and groups to specific roles.

At times, we may want to restrict this ability. For example all users are part of the "jira-users" group, which grants login access. A project admin, may add this group to certain roles, essentially granting the whole instance access.

In this case, it would be useful if we can mark "jira-users" as a group that should be restricted from project admins.