Support CRM contacts only in root groups

What does this MR do and why?

Related to #350634 (closed)

• contact "dupe check" now only occurs within the same group (no need to check the hierarchy)
• contact validation added to prevent creating in subgroups
• issue contact validation updated to only allow contacts belonging to the root group of an issue
• organization validation added to prevent creating in subgroups
• quick action only checks root group for contacts to determine whether to be available

MR acceptance checklist

This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.

• I have evaluated the MR acceptance checklist for this MR.