migration: Add `-noop-privileged` flag

Created by: efritz

This PR adds a -noop-privileged flag to the migrator subcommands up, upto, and downto. this flag is a sibling to the -unprivileged-only flag, which controls how to behave in the presence of a privileged migration.

There are now three behaviors:

• Apply privileged migrations as if they were unprivileged (the default)
• Fail when privileged migrations are encountered, prompting the user to apply a migration manually (enabled via the -unprivileged-only flag)
• Warn when privileged migrations are applied; mark them as applied but do not actually apply them (enabled via the -noop-privileged flag)

Fixes #38046 (closed).

Test plan

Tested manually with new local privileged migrations.