add `create: rejectgroup <applicant>` or similar

[mcint]

Let's bounce users to the right resource. It's a better experience than an inexplicable no.

Most of the work will be in ocflib. I'll make an issue there as well.

[jvperrin]

Probably just a general create: reject <applicant> <reason> would be general and easy to remember for any number of reasons (and if a reason isn't given, just default to the current state I suppose)