Right now on the primary the TenantMigrationAccessBlocker is created inside the constructor for TenantMigrationDonorService::Instance, whereas on secondaries it is created by the OpObserver on observing the transition to blocking state. When a secondary steps up, PrimaryOnlyService::_rebuildInstances can fail with ConflictingOperationInProgress when creating TenantMigrationDonorService for active migrations since the secondary already has the TenantMigrationAccessBlockers for those migrations. To avoid this, we should construct TenantMigrationAccessBlocker on observing insertion for state doc with state "data sync".