Even though it does modify the participants of the notification target in some
cases, this should have been safe, as different workers are responsible for
creating the notifications for each target. However, this is at best confusing,
and we should ensure we don't do that.
Create a post-deployment migration to update all existing notification settings
with at least one custom level enabled to the new format. Also handle the same
conversion when updating settings, to catch any stragglers.
1. Never send a pipeline email to anyone other than the user who created
the pipeline.
2. Only send pipeline success emails to people with the custom
notification setting for enabled. Watchers and participants will
never receive this.
3. When custom settings are unset (for new settings and legacy ones),
act as if failed_pipeline is set.
