refreshGivenShares

Re-validates each given share against the resource's live ACL, drops entries no longer granted, and returns the verified list.