Upgrade step helper for updating security settings on workflow update

If we update a workflow we usually want to update the object security of exactly those objects which use this workflow at the moment.

The new `update_workflow_security` does the job with minimal effort:
- pass in a list of names of the changed workflows
- it guesses the types of possible affected objects (using the workflow tool and supporting placeful workflows)
- it gets only those objects and rechecks the workflow
- it reindexes only the resulting objects
- the `update_workflow_security` supports disabling security reindexing (when ``View`` was not changed)

/cc @maethu