Update "revoke role from group" API

[christophermaier]

With the restriction that the cog-admin role cannot be revoked from the cog-admin group, the contract for role revocation changes from something that can always occur, to something that can now fail. The API needs to be updated to reflect this, and corresponding updates to cog-api-client, cogctl, and flywheel need to occur.