Fix: use .distinct() for existing-grant lookup, drop flaky query-count invariant tests

.distinct() lets the database dedupe identity ids server-side instead of
transferring one row per (object, grantee) match and deduping in Python --
was the dominant cost on a large selection with existing grants.

Also replaced the two query-count-equality tests (bulk_edit and the
bulk_edit_objects API path) with plain functional-correctness checks at
both batch sizes.  Hopefully stops that flake.

src/documents/permissions.py

@@ -229,7 +229,9 @@ def _apply_bulk_permission_entry(
                 content_type=ctype,
                 object_pk__in=object_pks,
                 permission__codename=codename,
-            ).values_list(f"{identity_field}_id", flat=True),
+            )
+            .values_list(f"{identity_field}_id", flat=True)
+            .distinct(),
         )
         remove_ids = existing_ids - add_ids
         if remove_ids: