Add new MergeRequests::SyncCodeOwnerApprovalRulesWorker

MergeRequests::SyncCodeOwnerApprovalRules#execute out of MergeRequests::UpdateService#after_update - we call it synchronously, but I don’t think it is strictly required to be sync.. it adds “only” 3 queries to an otherwise bare/empty repo (one without Code Owners) but for a project that does, it’ll add those 3 + (2x the number of CR rules that are new and thus aren’t currently applied to the MR) + (the number of rules where users list has been changed) + (the number of rules where the groups list has been changed)

Related to #325691 (closed)