fix: Skip CreateOrUpdateDefaultTrackedContextWorker on Geo secondaries

What does this MR do and why?

On Geo secondary sites, Security::ProjectTrackedContexts::CreateOrUpdateDefaultTrackedContextWorker was failing with PG::ReadOnlySqlTransaction when handling Repositories::DefaultBranchChangedEvent. The worker attempts to write to the sec database, which is read-only on secondaries, causing repeated Sidekiq retries.

This MR prepends ::Geo::SkipSecondary to the worker so it exits early on Geo secondary sites, consistent with other write-heavy workers (e.g. Security::SyncProjectPolicyWorker) that must only run on the primary.

References

• Closes #594325 (closed)
• Geo worker attributes docs: https://docs.gitlab.com/development/sidekiq/worker_attributes/#skip-execution-of-workers-in-geo-secondary

Screenshots or screen recordings

N/A — no UI changes.

Before	After

How to set up and validate locally

1. Set up a Geo secondary GDK instance.
2. Trigger a default branch change on a project (e.g. via the API or UI).
3. Before: Sidekiq logs on the secondary show repeated PG::ReadOnlySqlTransaction errors from Security::ProjectTrackedContexts::CreateOrUpdateDefaultTrackedContextWorker.
4. After: The worker logs a skip message and returns immediately without attempting any DB writes.

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.