[identity] Verify UpdateDeviceList RPC is called by primary device

Summary:
Addresses ENG-8549.
The only place with missing check was UpdateDeviceList.

Test Plan:

• Had user with two mobile devices (primary and secondary)
• Called the RPC with different auth metadata - switched device_id metadata between primary and secondary
• The RPC accepted request from primary device and rejected from the secondary.

Note that the RPC can also reject requests because of invalid signature so it's good to test it without signatures.

Reviewers: varun, kamil

Reviewed By: kamil

Subscribers: ashoat, tomek

Differential Revision: https://phab.comm.dev/D13042