batches: Isolate ssh credentials oobmigration

Created by: efritz

This PR isolates oobmigration #2 so that it does not need any behavioral imports that can change over time. This is in preparation for its deprecation, where it will run only as part of the migrator for historic upgrades. We want to freeze this migration as much as possible, because we want to treat it with consistent behavior over time to allow the migrator to make some assumptions (like the registered code for an oobmigration is valid at any point in its lifetime).

This PR makes progress towards #38052 (closed), but still needs to be fed configuration keys from the worker. A follow-up PR will take care of this.

Test plan

Existing unit tests.