Allow self-service group verification

[tobias]

We've been manually verifying groups for a little over a year and a half, and I think we have vetted the methods we use pretty well. We had a plan to move the manual verification from the REPL to an Admin UI, but based on discussions with @danielcompton, I think we should instead just make group verification self-service.

This would allow a user to verify:

• a reverse-domain group via a TXT record
• a VCS-based group via a public repo
• a subgroup of an already verified group

We would still retain the REPL utilities in case we need to verify any edge cases.

TODO

• implement self-verification
• update documentation in the wiki
• announce on clojure@