Imagine we have an action cache-text/foo referencing an ipblock abuse/bar and a pattern ua/baz.

An SRE wants to remove all of them. They first remove the action, because otherwise requestctl would deny the removal. Then they remove the pattern, and finally the ipblock.

When they do this last action, it has an immediate effect on varnish/haproxy as ipblocks are mostly injected as part of netmapper files (varnish) or maps (haproxy) and that wouldn't be problematic, as we would just fail to match the ipblock from that moment on.

But abuse ipblocks are treated as ACLs by varnish, and this are matched against by label. So until we commit the changes due to the removal of the action, removing of the ipblock will generate invalid VCL.

We need the cli to refuse removal of ipblocks in the "abuse" scope if there are uncommitted changes. Unclear if we want to ensure this also when running dump/load but for now I'll leave those out.