[Domain Control] [Release 4] [BE] Split Auth UpdateDomainSecurityGroup into 3 separate commands

[allgandalf]

Part of #85903

Description

The Web-E layer now has 3 separate API commands (CreateDomainSecurityGroup, DeleteDomainSecurityGroup, UpdateDomainSecurityGroupForNewDot) per the 1:1:1 philosophy discussion. All 3 currently route to a single Auth UpdateDomainSecurityGroup command which dispatches internally based on the value.

To fully align with 1:1:1, we should also split the Auth command into 3:

• CreateDomainSecurityGroup (Auth)
• DeleteDomainSecurityGroup (Auth)
• UpdateDomainSecurityGroup (Auth)

The shared helpers (shareSecurityGroupRestrictedPolicyOrDefer, validateRestrictedPrimaryPolicy) are already extracted so this is mostly a refactor of the dispatch logic.

Conversation: https://expensify.slack.com/archives/C0A1VKRKEE9/p1773990224163049

Issue Owner

Current Issue Owner: @jnowakow

[allgandalf]

I will put the hot pick label once we have the other PR's merged and will unassign myself

[allgandalf]

c.c. @rayane-d in case you want to include this in your weekly updates

[allgandalf]

Removing my assignment as per #87557 (comment)

[jnowakow]

I'll pick this one!