[Feature] Support separate datastore_uris for migrations and application access

[jackwellsxyz]

Overview

Currently, spicedb-operator supports a single datastore_uri connection string for both database migrations (via spicedb-operator) and normal SpiceDB application access by passing this string through to the SpiceDB pods the operator spins up. I'd like the operator to instead support two different connection strings, since the migrator would need elevated access to e.g. create/drop tables that the SpiceDB application shouldn't.

Suggested solution

I'd suggest adding support for a secret key called migration_datastore_uri that, if present, is used for migrations instead of datastore_uri. This new secret key is not passed to the SpiceDB application.