Split reads for new group and instance Microsoft Applications tables

We've recently completed a data migration for the
`system_access_microsoft_applications` table and related tables. This MR
implements the second half of the transition to the two tables, allowing
reading off the new table for specific groups, controlled by a feature
flag.

During the transition, new records and updates to the Microsoft
Applications table are written to both new and legacy tables, so we can
seamlessly enable and disable the feature flag. When the transition is
complete, we can remove the feature flag and drop the legacy data.