Add BBM to migrate OTP secrets

What does this MR do and why?

Create a BBM that copies the two-factor authentication OTP secret from the legacy column into the new otp_secret column for all users. This prepares us to safely drop the legacy column in a later step.

This MR is follow-up from Update devise-two-factor gem to v5 (!213678 - merged), and it's introducing Phase 2: Clean up

References

• !213678 (merged)
• Upgrade devise-two-factor and devise-pbkdf2-enc... (#422927 - closed)
• [Cells 1.0] (Size: S) Migrate to `devise-two-fa... (#451147 - closed)

Screenshots or screen recordings

N/A

How to set up and validate locally

1. Checkout the branch
2. Verify that you have several users with encrypted_otp_secret fields, but without otp_secret field populated
3. Trigger the migrations rails db:migrate
4. Verify that those users are having now otp_secret field filled out 🎉

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.