[identity] Make apply_devicelist_update more generic

Summary:
Currently, apply_devicelist_update requires a device list validator, and also has side effects (removes device data when it's removed from the list).
Usually we want this, but there are usecases when either of them is not needed - when these actions are performed externally.

Depends on D12588

Test Plan: Commtest. Confirmed that UpdateDeviceList RPC still works as expected - validates the device list and removes device data.

Reviewers: kamil, varun, will

Reviewed By: kamil

Subscribers: ashoat, tomek

Differential Revision: https://phab.comm.dev/D12589