Add `filter` option to update/destroy actions

These `filter` options would be applied when building a changeset just before calling the action (so they can't be controverted), and could also be lifted to the `read` action when used in a bulk update/destroy scenario

No files or tests are named. Start by tracing how a changeset is built before update and destroy actions, then inspect the bulk update/destroy path where the filter could be lifted to the read action. Done means filter options are applied before the action and behave consistently for bulk operations.

Written by the indexing model from the issue text.