Backend: Accept multiple group ids and project ids for add/remove

We currently accept multiple attributes to add and multiple attributes to remove through the securityAttributeProjectUpdate call, but we only accept one project id.

We need to change this to support multiple group ids and/or multiple project ids. We also need to maintain backwards compatibility.

For reference, a request to the current API looks like this:

mutation addAttrs {
  securityAttributeProjectUpdate(input:{
    projectId: "gid://gitlab/Project/32",
    addAttributeIds: [
      "gid://gitlab/Security::Attribute/business_critical",
      "gid://gitlab/Security::Attribute/30"
    ],
    removeAttributeIds: [
      "gid://gitlab/Security::Attribute/42",
      "gid://gitlab/Security::Attribute/67"
    ]
  }){
    addedCount
    removedCount
    errors
  }
}