WIP: prevent postgres from mutating migration history

[sweatybridge]

What kind of change does this PR introduce?

Bug fix

What is the new behavior?

Adds RLS policy to auth and storage schema to prevent postgres from accidentally updating migration history.

Additional context

Add any other context or screenshots.

[soedirgo]

Should we do auth first so we can limit the blast radius & not have to be blocked on supautils changes?

[soedirgo]

Removed the revoke/grant on auth.schema_migrations. postgres can already read all tables by way of pg_read_all_data through pg_monitor

[darora]

Are we good to roll this out? Or do we need additional testing - if so, what's the path forward?

We've tested that this doesn't break any of the flows that we've laid out in guides, e.g. setting up views on auth data, or triggers, etc?

Lastly, are we also planning to backport this to existing projects?

[soedirgo]

This still needs additional testing, and I'll be having the Auth team test some of the common flows.

And yes, we'll backport this to existing projects.