Defer PartnerTokenVerificationWorker on the sec database health signal

Overview

PartnerTokenVerificationWorker triggers SidekiqJobsDeferredByDBHealthCheck alert often in the g_ast-secret-detection channel.

The worker defers on the health of the main database: defer_on_database_health_signal :gitlab_main.

But every table it reads or writes is in gitlab_sec database instead:

• It writes security_finding_token_statuses and secret_detection_token_statuses.
• It reads security_findings and vulnerability_occurrences.

So the worker pauses when the main database is busy, though it puts no load there. It ignores the sec database, which it writes to.

It also lists no tables, so the autovacuum check never applies, and it uses the 5-second default delay.

Proposal

Replace the existing line with:

defer_on_database_health_signal :gitlab_sec,
  [:security_finding_token_statuses, :secret_detection_token_statuses], 1.minute

This matches other gitlab_sec workers, such as:

• Security::SyncFindingEnrichmentWorker
• Security::Scans::IngestReportsWorker

The goal is to defer on the right signal, not to stop the alert.