[1/3] subgroups

this is the first in a series of 3 pull requests to implement subgroups which closes #1872

models
- add GroupID field to Repository struct
- new (to add)
  - Group
  - group-team relation stores a team’s access level to a group
  - GroupUnit like a repository unit, but grants or denies access to a specific unit at the group level. will override unit permissions defined on a team
misc
- update GetUserRepoPermission function to take into account group permissions
- update GetTeamRepositories to take into account group permissions
- update condition builder functions in models/repo/repo_list.go to check for group access
API access to these endpoints is governed by read:organization and write:organization scopes
- POST /org/{org}/groups/new → create a new group at the root level of an org
- /groups/{group_id}
  - GET → retrieves the group
  - PATCH → updates the group’s name and/or description
- GET /groups/{group_id}/subgroups → get a group’s subgroups
- GET /groups/{group_id}/repos → get a group’s repos
- POST /groups/{group_id}/new → creates a new subgroup inside a group
- POST /groups/{group_id}/move → moves a group to different group in the same organization, or to the root level if newParent is null or 0
- POST /{username}/{reponame}/groups/move → moves a repository to a different group within an organization, or to the root level if newParent is null or 0
- allow a group ID to be specified when creating a repository

_{/claim #1872}

Stack generated by Git-Town