### Description
This PR is the logical continuation of #8343 and #8357, and replaces both.
One core problem that this PR addresses: we had to create temporary a `HTTP.Manager` to initialize both the OSS and the Pro app: a manager is required to build the schema cache, but the dynamic TLS allow list is read from the schema cache... This PR solves this, by introducing the `TLSAllowListRef`, based on @abooij 's idea: it allows us to create a valid `HTTP.Manager` as soon as we have the metadata list, and then update the ref at a later point to make it point to the schema cache, allowing us to only build one and only one `HTTP.Manager`.
This paves the way towards building the schema cache _in the app monad_ and deprecating `CacheBuild`. Towards this, and also to clean the code, this PR also splits the catalog migration and the first schema cache build into two distinct functions. This doesn't result in a change of behaviour, as the transaction to update the catalog would always be done before attempting to build the schema cache.
PR-URL: https://github.com/hasura/graphql-engine-mono/pull/8421
Co-authored-by: Auke Booij <164426+abooij@users.noreply.github.com>
GitOrigin-RevId: 0e0402122b4fc008c1932bccbdbadf11878e27eb
