Add new MergeRequests::SyncCodeOwnerApprovalRulesWorker

What does this MR do?

Moves MergeRequests::SyncCodeOwnerApprovalRules#execute out of MergeRequests::UpdateService#after_update - we call it synchronously, but I don’t think it is strictly required to be sync.. it adds “only” 3 queries to an otherwise bare/empty repo (one without Code Owners) but for a project that does, it’ll add those 3 + (2x the number of CR rules that are new and thus aren’t currently applied to the MR) + (the number of rules where users list has been changed) + (the number of rules where the groups list has been changed)

In order to do this, I also had to do some work around the context of what to do when we call MergeRequest::UpdateService from inside a transaction. This normally isn't much of an issue, but Milestones::DestroyService does a LOT of work inside of transactions, and I tried to reorganize and extract only the MergeRequest::UpdateService call(s), but THOSE break then because we require the Milestone record to exist in order to create system notes about the milestone changing (due to a foreign key requirement)... so preventing worker scheduling during a transaction to prevent potential race conditions from occurring is the best immediate solution.

Related to #325691 (closed) and #326841 (closed)