Box provisioning: support per-tenant isolation of __BrighterMigrationHistory

[iancooper]

Context

__BrighterMigrationHistory (or BrighterMigrationHistory on Spanner) is currently created in the backend's default schema (dbo on MSSQL, public on PG, the connection-bound DATABASE() on MySQL), regardless of the configured SchemaName. Multi-tenant rows remain unambiguous because the PK is (SchemaName, BoxTableName, MigrationVersion), but physically a single history table is shared across all tenants in a deployment.

For operators running a separate schema per tenant — typically for isolation, backup-restore boundaries, or per-tenant retention policies — there is no way today to keep the migration history table out of the shared schema.

Suggested options (none committed yet)

• Honour IAmARelationalDatabaseConfiguration.SchemaName when creating __BrighterMigrationHistory (per-tenant history table; runner becomes schema-aware end-to-end).
• Or: expose a separate BoxProvisioningOptions.MigrationHistoryScope enum (Global (today's default) | PerSchema).

Either option needs a migration story for existing deployments that already have a dbo.__BrighterMigrationHistory populated.

References

• Raised in code review of PR Database Utilities for our boxes #4039 (reviewer item F2-5).
• Existing schema-routing fixes for fresh-install DDL: PR Database Utilities for our boxes #4039 commits df0e5a847, 2c719254e, c9ee00311 (F1a/F1b/F1c).