PostgreSQL sink: normalise repo permissions into a repo_users join table

[dcoric]

Follow-up to #1497 / #1532. Tracked by the TODO(#1497-followup) in src/db/postgres/repo.ts.

Repo permissions (canPush / canAuthorise) are stored as a JSONB column for v1 parity with the mongo/fs backends. A normalised repo_users(repo_id, user, role) table would be more queryable and indexable.

Depends on #1558 — existing JSONB data must be migrated into the new table.