Move chef disable into blocks/roles that perform changes not pre-checks

What

Moves chef-client-disable steps out of pre-checks

Why

Pre checks can and are run well in advance of an upgrade and disabling chef is undesirable as it can cause the DB host to get out of sync with chef configuration

https://gitlab.com/gitlab-com/gl-infra/dbre/-/issues/24#note_2074643777