Static group which depends on dynamic subgroup must be forbiden
We need to ensure consistency on a group and its subgroup.
Consistency seems to be: a group with subgroup query and that group MUST BE dynamic, other cases seems to be ok:
- dyn parent / dyn subgroup => OK
- dyn parent / static subgroup => OK (subgroup just never change, or if it change with a new save, parent is computed again)
- static parent / static subgroup => actually, perhaps not good, because if a subgroup is changed, parent won't be recalculated (which would mean that actually, the parent group will be dynamic)
- static parent / dyn subgroup => breaks.
The idea is to forbid saving group as static with subgroup with a helpful message + have an other check during policy generation (and breaks ?)