Add row-level security to individual and group

[weilu]

The individuals and group beneficiaries will need to have location-based row-level security functionality added, similar to how it is implemented in the insuree module. This will allow a district officer to only view individuals, groups and program beneficiaries of their assigned district(s).

This means the CRUD operations for a district user can only apply to individuals/groups/beneficiaries of the given location(s), same goes for enrollment.

For batch import of individuals and groups via csv, recognize and import the location column. Fail the records with unrecognized location while allowing the rest of the records to be imported. Include the failed records in error messages or allow downloading of the failed records. Check how beneficiary upload works.

With row security, when a user doesn't see all beneficiaries in a program they should be shown the total number when appropriate, e.g. total enrolled active etc.

[weilu]

This story is very big in scope considering the changes required. I'm going to split out benefit plan and beneficiary into a separate ticket