Implement shared logic for computing ACL updates for relevant locations

Currently we don't have a single shared logic for determining which locations should receive an updated firewall config.

This leads to issues like https://github.com/DefGuard/defguard/issues/3643

Instead of hand-rolling logic for determining affected locations in multiple places or using a sub-optimal crutch like calling `sync_all_networks` just in case, we should consider implementing a shared helper, which would take the IDs of changes users & groups, analyze the location-level allowed groups as well as ACLs and send updates to locations which actually need them.

This will also allow for batching the updates, so a gateway event is not sent for every single operation like in `delete_user_and_cleanup_devices`.