Be more db-friendly when purging expired userrights

Be more db-friendly when purging expired userrights

Each expired row has to be fetched from the user_groups table, deleted
from that table and added to the user_former_groups table.  Per Jaimes
request, let's not do this for all rows at once but for smaller chunks
and wait for replication to catch up after each chunk has been
processed. In addition the function to purge the expired rows now sets a
lock so that there won't be multiple concurrent runs.

Also, cleaning this table up isn't urgent and thus should be done in a
job and not a deferred update, so let's move it there.

Bug: T176754
Change-Id: I671d4b9d09677a2f474477ba7fea33a44d6318aa