Add constants for service tenant and default security group

Add SERVICE_TENANT_NAME constant for service tenant, should be
used to preserve service users and tenant
Add RO_SECURITY_GROUPS list to specify read-only security groups,
used for cleanup purposes
Move migration.py script to scripts/ directory