Lock-down "superuser" configuration on groups

[Anderen2]

Is your feature request related to a problem? Please describe.
Currently every user with RBAC access to add or change a group may elevate the group to superuser and thereby gain more access.

Describe the solution you'd like
The superuser configuration should be moved out from groups, or locked down behind a separate global permission (note global, because if this is moved to a RBAC object-level permission we still have the same issue, just with one more step)

Describe alternatives you've considered
N/A

Additional context
N/A