Change the way Access settings work

### Prerequisites

- [X] I have checked the [Wiki](https://github.com/AdguardTeam/AdGuardHome/wiki) and [Discussions](https://github.com/AdguardTeam/AdGuardHome/discussions) and found no answer

- [X] I have searched other issues and found no duplicates

- [X] I want to request a feature or enhancement and not ask a question

### The problem

Currently, we implemented Access settings differently in AdGuard Home and AdGuard DNS.

In AdGuard Home "Allowed clients" and "Disallowed clients" work the following way:
If an IP address (let's take 1.2.3.4) belongs to "Allowed clients" then this IP address is allowed and ALL other IP addresses (that don't belong Allowed clients) are **automatically disallowed**.

In AdGuard DNS it's implemented like that:
If an IP address belongs to "Allowed clients" then it is not checked against the "Disallowed clients". All other limitations are still apply (even the rate limiter). To achieve the old behavior it is necessary to add `0.0.0.0/0` to `Disallowed clients` when `Allowed clients` is not empty.

I think we should have a uniform implementation in both AdGuard Home and AdGuard DNS, and tbh I like the one in AdGuard DNS more.

### Proposed solution

* [ ] Change the implementation in AdGuard Home to match the one in AdGuard DNS.
* [ ] In addition to that, change the fields description in the UI to match the new behavior.
* [ ] Implement settings migration in the following way: if "Allowed clients" is not empty, then add `0.0.0.0/0` to `Disallowed clients`.

### Alternatives considered and additional information

_No response_