Immediately invalidate ROFL app instances on policy change

[kostko]

Currently when a ROFL app's policy changes the existing instances stay valid until their registrations expire (as registrations cannot be refreshed due to the policy not being satisfied). This should be changed such that existing instances are immediately invalidated. There is no need for the registrations to be removed, just the origin authorization check should immediately start failing.

The implementation can use a policy serial number to ensure this without too much overhead.