[management] Push network maps when background validation changes (#8299)

An integrated validator can approve or revoke peers outside a login or
sync, for example during a periodic EDR sync. Only revocations of SSO
peers reached anyone; a newly approved peer kept its empty map, and its
peers did not see it, until an unrelated update or a reconnect.

Add SetPeerValidationChangeListener to the IntegratedValidator interface.
The account manager registers a handler that resolves the affected peers
and calls OnPeersUpdated, the same path a login-time approval takes. The
OSS validator and the mock implement it as a no-op.

management/server/integrations/integrated_validator/validator/validator.go

@@ -55,6 +55,9 @@ func (v *IntegratedValidatorImpl) PeerDeleted(_ context.Context, _, _ string, _
 func (v *IntegratedValidatorImpl) SetPeerInvalidationListener(_ func(accountID string, peerIDs []string)) {
 }
 
+func (v *IntegratedValidatorImpl) SetPeerValidationChangeListener(_ func(accountID string, peerIDs []string)) {
+}
+
 func (v *IntegratedValidatorImpl) Stop(_ context.Context) {
 }