Right now a change to enforce-first-as will cause a hard reset of the session. This could be much more graceful, given it is a policy change and not a session parameter change.

disabled -> enabled should trigger a rib walker that deletes all paths from the updated peer that fail the first-as check.
enabled -> disabled should trigger a route refresh (since we don't store unmodified routes in the adj-rib-in).