Bulk Update Access

Apply a batch of access-grant changes in one transaction with a single commit (PRO-1667) — powers the Manage Data Restrictions admin UI's Save action, whether the batch came from By Dataset mode, By Client mode, or "apply to all valid clients".

Fires exactly ONE Slack message summarizing the whole batch (not one per dataset/client) — see block_slack.send_bulk_access_changed.