Approveuser now does not allow non-project-owners to approve people as
group_root into the default group.

Modified editgroup form to show only valid trust options for "add users"
table.