[Backport 4.2.x] Restrict setting privileges on groups (#8511)

[Backport 4.2.x] Restrict setting privileges on groups (#8511) #368