No way to query v3/security_groups for all ASGs applied to a list of spaces

The security_groups endpoint has various query parameters (globally_enabled_running, globally_enabled_staging, running_space_guids, staging_space_guids) that work individually, but cannot be used together to fetch ALL security groups that may be usable for a set of spaces.

Since these are filters, they simply execute AND queries, meaning that you cannot fetch all security groups that have space A as a running space or a staging space (or security groups that are global).

Since as far as I can tell we don't have any prior way of indicating API clients would like to execute an OR query, I think resolving this is a bit tricky.

Potential solutions:

1. Implement a space_guids param that executes an OR for running_space_guids and staging_space_guids. Could also check for global availability, though that might be counter-intuitive.
2. Implement a way to specify OR queries. Would have to think deeply about this, as then we might be expected to implement that pattern for other endpoints.
3. Change the current behavior. Probably a no-go as it would be a breaking change.
4. Tell clients that they must use 4 queries to get all ASGs relevant to a space (not very good)
5. something else

cc @geofffranks

Start with the v3 security_groups endpoint and filters documentation linked in the issue; trace how running_space_guids, staging_space_guids, and global filters are combined. Agree on the intended OR semantics and API compatibility before locating the implementation. Done means providing a clear, compatible way to retrieve every applicable security group for a set of spaces.