Fixed #23641 -- Moved post_migrate signals registration for contrib apps to AppConfig.ready

In the case of the sites app this solves a problem appearing when
Apps.set_installed_apps (override/modify_settings) is used before
sending the post_migrate signal -- create_default_site handler is
not executed in such a case.

To elaborate a bit, the signal is connected with the sender attribute
equal to an AppConfig instance; the signal dispatcher stores its id to
identify the sender that we're interested in receiving the signals
from. Apps.set_installed_apps reinstantiates all of the app configs,
and thus when the migration machinery emitts signals using apps from
the global registry as senders, their ids don't match those stored by
the dispatcher. Signal handlers registered prior to set_installed_apps
don't get called.

Moving the "connect" to AppConfig.ready ensures that the signal will
be registered with any new app config instance. Note however that
the ready method may be executed more than once during testing, so
some signals need to be protected from double registration.
Could also move ``create_permissions`` (plus the three private functions) to ``auth/signals.py`` to avoid that. If I understand the "Where should this code live?" [note](https://docs.djangoproject.com/en/dev/topics/signals/#connecting-receiver-functions) correctly that's where it should be.