fix(admin): restrict user and group CSV export to application admins

Make the dr=export data requests on the manage users and manage groups
pages enforce on the server side that the current session belongs to an
application administrator, following the guard pattern used in the
recent delegated administration changes. The group export includes the
full group permission list, which is application administrator
material under the delegated administration model.

Hide the Export menu items with new CanExportUsers and CanExportGroups
flags, and hide the header dropdown toggles entirely when no items in
them are available. Document the restriction in the administration
guide.

Assisted-by: Claude:claude-fable-5