feat: add constraint so non-idir user cannot be given staff access group

[john-fletcher-aot]

Description

Add a constraint on the company_user table so a BCEID user cannot be given a staff access group inadvertently

Fixes # ORV2-1712

Type of change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• This change requires a documentation update

How Has This Been Tested?

• Ran database update locally in Docker, confirmed no outstanding errors or test failures reported in logs
• Review database objects in SSMS after loading in sql server container to verify all appear as expected
• Attempt to change a company user's role to an IDIR group, confirm am not permitted to do so

Checklist

• I have read the CONTRIBUTING doc
• I have performed a self-review of my own code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• My changes generate no new warnings
• I have added tests that prove my fix is effective or that my feature works (manual test only)
• New and existing unit tests pass locally with my changes
• Any dependent changes have already been accepted and merged

---

Thanks for the PR!

Deployments, as required, will be available below:

• Frontend
• Vehicles
• Dops

Please create PRs in draft mode. Mark as ready to enable:

• Analysis Workflow

After merge, new images are promoted to:

• Merge Workflow

[praju-aot]

Approved