Refactor DeploymentTracker in preparation for auto-deploy on security

This adds a generic create_deployment method that takes the project, ref, sha, and tag status as arguments, then updates the existing methods to call it.

This should be identical to existing functionality.

When auto_deploy_on_security is enabled, we'll want to create an additional deployment for each of the three projects, where we explicitly track master on Canonical so that merge requests there get notified even when an auto-deploy branch only exists on Security.

This is foundational work to support the "create deployments in two separate repositories" strategy outlined in gitlab-com/gl-infra/delivery#1031 (comment 384025955).