Disable changing resources on application that would violate catalogue item hierarchy

Add `invalid-catalogue-item-hierarchy-error` to `change-resources` command handler

In following UI,
- filter dropdown options so that available are only those complementary items that belong to current hierarchy on application, and those which the applicant already has entitlement to
- disallow removing the top-level item as long as it's complementary items are present