Forbid creating streaming destinations for subgroups

What does this MR do and why?

• Updates the externalAuditEventDestinationCreate mutation to return an error when attempting to associate with any group that has a parent.
• Changes the model validation to facilitate this.

Screenshots or screen recordings

✅ Group	❌ Subgroup

How to set up and validate locally

• Create a group.
• Create a subgroup within it.
• (As an owner) Try to create an audit event destination on the root group. It should succeed.
• (As an owner) Try to create an audit event destination on the subgroup. It should fail with the error "Group must not be a subgroup"

Example GraphQL Query

mutation {
  externalAuditEventDestinationCreate(input: { destinationUrl: "https://example.com/test.json", groupPath: "FULL PATH HERE", clientMutationId: "requestBin" } ) {
    errors
    clientMutationId
    externalAuditEventDestination {
      destinationUrl
      verificationToken
      group {
        name
      }
    }
  }
}

MR acceptance checklist

This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.

• I have evaluated the MR acceptance checklist for this MR.