Allow capital schemes data source to be externalised

[Sparrow0hawk]

Support two modes of operation:

1. Self-contained: the app database contains both capital schemes and users, and migrations for both are applied
2. Externalised: the app database contains just users, and an external data source is configured to fetch and update capital schemes. Migrations will only be applied to the app database.

This will allow the ATE capital schemes database to be used in hosted environments.

Dev and test environments should be configured to both use the ATE capital schemes database test environment. The API should also been disabled for these environments.

[markhobson]

Tasks

• [x] Allow database to be partitioned for capital schemes and app data
• [x] Allow app GCP project to access capital schemes database
  • [x] Add new Cloud Run environment variable for FLASK_CAPITAL_SCHEMES_DATABASE_URI
  • [x] Create URI in schemes-database and add as a secret
  • [x] Get URI secret from schemes-database project into schemes cloud run variable
  • [x] Give roles/cloudsql.client permission to schemes cloud run service account
• [x] Configure capital schemes database URI for dev/test (share Terraform state across root modules)
• [x] Disable API in dev/test