RFC 697: Check privileged application state prior to migration application

Created by: efritz

See RFC 697: Multiple version upgrades.

A follow-up from #38687. When privileged migrations are in the set of migrations to be applied, we should fail-fast before making any changes to the schema. Currently, we exit (or prompt) only at the point where that schema is applied.