Allow assignments only on group

we need an option under "assigning provisioning" called

"Allow assignments only on groups"

Description: If folders should not be able to be marked as provisionable, e.g. if there is metadata on groups which is required

Note, if this is false, and there is a required metadata only assignable on groups, then also do not allow provisioning on folders.

This can be tests on an "only DN" LDAP provisioner