Bug: Find the old user group by ID, not code

In Security#updateUserGroup, we look up the current group this way:
UserGroup oldGroup = findUserGroupByCode(group.getCode());

This approach fails with NullPointerException as soon as the group's code is modified. Use the ID instead.