Before, for new hosts the code checked whether the host is part of any
restricted hostgroup only if the host's groups got modified directly.
I honestly don't know how that should be possible, since one can't add
host groups directly if restricted.
Now, for new hosts the code checks whether the resolved host groups
match at least one of the restricted host groups.
