Fix updating target-users and target-groups.

This change adds some local-site knowlege to the target-users and target-groups
field settings, and fixes the invalid object detection to match the new webapi.

Specifically, we weren't checking the local site for target objects, which meant
that if you were trying to set a group in a local site, it just would never find
it, and it would allow setting users on a review request whether or not they had
access to your site.

In addition, the error handling for invalid items was broken, so trying to set
one would just leave the "loading" spinner going forever. I fixed this by
updating the json object traversal to match our new layout, and by passing the
actual draft object back to the client with invalid-fields errors so the webui
can set the fields to their true values.

Tested adding groups and users from various different sites, and lots of testing
of invalid items.