This ticket should make it so only the atlasAdmin user can run these commands by:

• Creating a new ActionType for running tenant migration commands (see current list of ActionTypes)
• Making donorStartMigration and donorForgetMigration (and donorAbortMigration) override their doCheckAuthorization methods to check that the user is authorized for the tenant migration ActionType (see example)
• Ensuring Cloud assigns the atlasAdmin user permission for the tenant migration ActionType