Add row-level security to individual and group

[weilu]

The individuals and group beneficiaries will need to have the "row security" functionality added, similar to how it is implemented in the insuree module. This will allow a district officer to only view individuals, groups and program beneficiaries of their assigned district(s). "Enrollment officer" role allows for more fine-grained location based access control at the municipality or village level.

This means the CRUD operations for a district user can only apply to individuals/groups/beneficiaries of the given district(s), same goes for enrollment.

For batch import of individuals and groups via csv, the uploaded csv must have the district column, otherwise show error "missing district column" and prevent csv upload. Fail the records with unrecognized districts while allowing the rest of the records to be imported. Include the failed records in error messages or allow downloading of the failed records. Check how beneficiary upload works.

With row security, when a user doesn't see all beneficiaries in a program they should be shown the total number when appropriate, e.g. total enrolled active etc.

[weilu]

This story is very big in scope considering the changes required. I'm going to split out benefit plan and beneficiary into a separate ticket