Add LOCAL_GROUPS setting to disable local groups everywhere

[ThiefMaster]

This is a prerequisite for #3040 (see the comments there).

• Add a new LOCAL_GROUPS (default: True) setting for indico.conf
• Add it to the docs for the indico.conf settings
• If local groups are disabled with this setting, then:
  • Hide local group features in the admin area
  • Do not return local groups when searching for groups
  • Always return false when checking membership against local group (in case local groups were created and added to ACLs before turning off the setting)
  • Make sure saving such an ACL fails gracefully. We do something similar for remote (multipass) groups which do not exist anymore. Keep in mind that we have different fields for ACLs; the React one used e.g. in the Room Booking settings, and the classic one used e.g. when editing the protection of an event. I think principal_from_fossil and principal_from_identifier are the places to look at for this.