Before this change we were allowing maintainers to manage
group variables even though our permissions page list only owners.