batches: implement backend for the webhook banner

Created by: LawnGnome

Fundamentally, this adds two new fields to the BatchChange GraphQL type: hasExternalServicesWithoutWebhooks and externalServicesWithoutWebhooks. The former is available to all users, and returns a simple boolean indicating whether the webhook banner should be shown. The latter is only available for site admins, and lists the external services that don't have webhooks for that batch change.

There are two major complications in this commit:

1. As webhook configuration is contained within the possibly encrypted configuration blob in the external service record, this can't be done as a single query, and the relevant store and resolver methods are more complicated than is ideal as a result.
2. The testing scenarios here are quite complicated: they have to take into account differing user levels, private repositories and external services, and the fact that this is ultimately keyed off the changesets in a batch change. A new fixture concept has been added to the Batch Changes testing package to accommodate this.

Relates to #24310 (closed), although it doesn't close it by itself.