Add migrate_role_binding_scopes management command for migrating existing role bindings

• Add CJI job configuration for running the migration in production
• Add comprehensive tests for the migration command

This migration ensures existing role bindings are updated to use the new permission scope-based binding levels.