Alembic migration: backfill domains.allowed_docker_registries into ASE (scope=DOMAIN, entity=CONTAINER_REGISTRY)

## Description

Following the pattern of alembic revision `2e42a745f939`, add a migration that backfills domain↔registry associations from the legacy ARRAY column into `association_scopes_entities`. The ARRAY column itself is preserved (dual-write transition).

## Upgrade

- Insert `CONTAINER_REGISTRY` entity-type permissions for every relevant role × domain-scope combination, using `ON CONFLICT DO NOTHING` to stay idempotent.
- For every `domains` row, resolve each name in `allowed_docker_registries` against `container_registries.name` and insert ASE rows `(scope=DOMAIN, scope_id=domain.id, entity=CONTAINER_REGISTRY, entity_id=registry_id, relation=auto)`.
- Fan-out when a name resolves to multiple registries — insert one ASE row per matching registry id.
- Leave the ARRAY column intact; no schema change in this migration.

## Downgrade

Remove ASE rows where `(scope=DOMAIN, entity=CONTAINER_REGISTRY, relation=auto)`. Permissions rows added in upgrade are also rolled back.

## Success Criteria

- Migration is idempotent (safe to re-run).
- Verified locally for empty ARRAY, single-name, ambiguous-name (same name, multiple registries), and global-registry cases.
- Downgrade removes only domain-scoped CONTAINER_REGISTRY AUTO rows; project-scope rows from prior migrations remain untouched.
- pants check passes.

JIRA Issue: BA-5787