Enable permissions to be added to sub-groups

There needs to be a way to add permissions to sub-groups so that we can set up consultants with access when they need to work with a specific team without giving them access to all of the processes.

I understand this would be a structural change but the current workaround of making the process group a top-level group isn't really viable longer term.

"Subgroups inherit permissions assigned to top-level groups. Inherited permission can be removed. You cannot add permissions for subgroups."