Lookup permission groups by name

When a top-level permission group is specified, lookup the group id
by name instead of parsing the value as an integer. This matches
what we do when the group tag is a child of <permission/>.

Change-Id: I54954ae683cecdf72cf846f75383bf6ba862dc5b