Restrict group level approval settings to top level group

Problem to solve

Resolving deeply nested group level approval settings poses some performance concerns. For the group level approval settings MVP, we would like to minimise this risk and restrict the ability to manage group level approval settings to only the top-level group.

Proposal

Restrict the ability to manage group level approval settings to only the top-level group in both UI and API

• backend Do not show group level approval settings in the UI if it is not top-level group (update helper method)
• backend Do not authorise API access if not top-level group if it is not top-level group (update API)