arrproxy: bump images to v0.5.0 (per-token method scoping)

arrproxy v0.5.0 adds per-token HTTP method scoping for machine tokens, so a
minted token can be limited to e.g. GET only. Existing tokens keep an empty
methods list and stay unrestricted.

- Bump arrproxy-api and arrproxy-ui pins to v0.5.0
- Mirror migrations 0002_tier_tokens.sql and 0003_token_methods.sql into the
  migrations ConfigMap, which had drifted at 0001 while v0.4.0 already queried
  tier/read_only and v0.5.0 queries methods
- Have the wave-1 migrate Job apply all three files in order (every statement
  is idempotent, so a resync over a migrated database is a no-op)

apps/base/arrstack/arrproxy/api-deployment.yaml

@@ -34,7 +34,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: api
-          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/arrproxy-api:v0.4.0
+          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/arrproxy-api:v0.5.0
           imagePullPolicy: IfNotPresent
           ports:
             - containerPort: 8080