refactor notification and enrollment ID capabilities

[jessepeterson]

Previously any change to a set, enrollment, or declaration would trigger a notification (which, in turn, sends out the MDMv1 DeclarativeManagement command). This PR introduces the capability to set a nonotify=1 URL param which defers notification for your actual changes. We also introduce a /v1/notify?... endpoint which allows specifying all changed items. To enable this the storage backends now "roll-up" all the enrollment IDs (to optimize the case of many overlapping set<->id<->declarations). It is hoped, in the end, that this reduces unnecessary notifications (MDMv1 command sends) and reduces load for both KMFDDM and e.g. NanoMDM.

With the above added support we introduce a new tool: ./tools/syncdir.py. From its docstring:

KMFDDM sync tool. This tool synchronizes declarations and sets from a directory and uploads them to a KMFDDM server. It tries to be smart about only notifying the changed items (declarations, sets) and only performing one set of notifications for all changed items.