Migrate restrict_user_defined_variables to `true`

This adds a Batched Background Migration that migrates the CI/CD
setting `restrict_user_defined_variables: false` to `true` while
also keeping the behavior backwards compatible by updating
`pipeline_variables_minimum_override_role: :developer`.

This migrations is necessary in order to deprecate the setting
`restrict_user_defined_variables` in 18.0.
In order to do that we need to have set the setting
`restrict_user_defined_variables: true` everywhere and solely
rely on `pipeline_variables_minimum_override_role`.

Changelog: changed