Separate database migration process from application runtime

[ryanhofdotgov]

Backend api process will automatically execute SQL in files in the migrations directory, depending on the value of DB_MIGRATION_TARGET and the skip-migration command-line parameter.

Improve privilege separation by:

• moving migration code into separate tool
• reduce privileges of PostgreSQL account used by backend api executable so as not to have any DDL modification permissions.

Mitigated by container deployment environment (container access restrictions, file system permissions, etc.) where write access to migrations implies ability to affect the entire backend.