workflow_create auth fix

Problems:
1. workflow_create doesn't limit creation of a job into a restricted group.

make sure workflow_create action is required on appropriate job match definition to create a Job/rename a Job

example:

given:

<context project="*">
   <command job="*" group="monkey.*" actions="workflow_create"/>

or

rules:
    'monkey.*':
      actions: [workflow_create]

then Job creation (or rename) is allowed only if the job matches group "monkey.*", and cannot be created in another group.