Fix: xml: Preserve ACL reference behavior for replaced constraints

Location constraints with multiple top-level rules are replaced with
multiple new constraints (one for each rule). If an ACL permission's
"reference" attribute referred to the original constraint's ID, the
permission would be dropped since the ID no longer exists.

Here, we preserve behavior by transforming the reference attribute into
an xpath attribute that matches the new constraints.

Note: if the ACL permission begins with an xpath attribute that matches
the ID of the original constraint, behavior is not preserved. The xpath
attribute value is unchanged, and it may not match the newly created
constraints.

Ref T898

Signed-off-by: Reid Wahl <nrwahl@protonmail.com>