It will only hold _valid_ entries for as long as it held in memory. Any change
regarding acl_users or acl_roles in memory should update the structure
immediately. This is why the rebuild_roles_mappings no longer removes invalid
entries.

In order to keep things consistent with the existing code, the following jobs
are assigned to each function:

The role of rebuild_roles_mappings is to recreate the links between users and
roles. Any other updates are to be done in the functions:

handle_grant_*

This change prepares the code for the next step, which is cascading updates.