Migrate subscription evaluators

Move the key's Organization's Subscriptions from one version of an alert-rule plugin to the version the active Pipeline Plan serves, after that plugin's upgrade or rollback. It looks at the Subscriptions that are not deleted, enabled or disabled, whose current Version pins plugin_id at from_version, in Subscription id order, at most limit of them, after after. Each one's Saved Query expression and evaluator configuration must validate against the served version's schemas first; one that does not is listed in refused with the first issue and keeps its version. A moved Subscription gets a new current Version that keeps its Saved Query Version, configuration and destination and pins the served version. Like an edit, it judges only changes committed after it, nothing is re-evaluated, Matches keep the Version that produced them, and subscription.updated is announced in each of its Corpora. dry_run true validates and lists what would move without moving anything. A call moves each Subscription at most once; calling again with next_after continues, and repeating a call converges. Subscriptions whose Corpora the key does not all grant are left out. 422 unsupported_evaluator when no version of plugin_id serves new Subscriptions, invalid_migration when from_version is that version. Requires plugins:admin.