This change adds support for adding multiple
IP subnets for restricting access to groups

These are not required because MySQL is not
supported anymore

:nested_groups clause was added to failing specs

- policies fixed
- schema updated
- Groups::UpdateService to handle params
- form added
- validate subnet, top-level group, and group presence
- ability to combine multiple IpRestriction removed
- avoid saving previous IP address in IpAddressState
- avoid user namespaces
- specs added
- license check added