add graph foreign key to nodegroup

[whatisgalen]

This issue is an outcome from this forum post. Basically, the nodegroups are the primary elements that makeup a graph and nodegroupids are unique globally. Given that many of the permissions methods focus on nodegroup-permissions, to get the graph it ought to be easy, but instead we do so via a roundabout nodegroup --> node --> graph, when the structure actually looks like this: graph --> nodegroup --> node. This issue also directly supports a solution for #11217 in that the existing methods to get nodegroup permissions could simply be extended to also supply resource-model permissions