iam: Isolate oobmigrations

Created by: efritz

This PR isolates oobmigrations #15 and #16 so that it does not need any behavioral imports that can change over time. This is in preparation for its deprecation, where it will run only as part of the migrator for historic upgrades. We want to freeze this migration as much as possible, because we want to treat it with consistent behavior over time to allow the migrator to make some assumptions (like the registered code for an oobmigration is valid at any point in its lifetime).

This PR fixes #39508 (closed).

Feel free to review by-commit which should make the refactoring a bit more clear.

Test plan

Existing unit tests.