add root_account_id to access_tokens

closes PLAT-5587

test plan:
* verify migrations run
* verify root_account_id can be set on an AccessToken
* verify AccessToken_s live on the same shard as their root account

Change-Id: I0183d39de21ae957eb49a2a68a6e750ab27060ad
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/235726
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
QA-Review: Xander Moffatt <xmoffatt@instructure.com>
Product-Review: Xander Moffatt <xmoffatt@instructure.com>
Reviewed-by: Rob Orton <rob@instructure.com>

db/migrate/20200429221913_add_root_account_id_to_access_tokens.rb

@@ -0,0 +1,32 @@
+#
+# Copyright (C) 2020 - present Instructure, Inc.
+#
+# This file is part of Canvas.
+#
+# Canvas is free software: you can redistribute it and/or modify it under
+# the terms of the GNU Affero General Public License as published by the Free
+# Software Foundation, version 3 of the License.
+#
+# Canvas is distributed in the hope that it will be useful, but WITHOUT ANY
+# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
+# A PARTICULAR PURPOSE. See the GNU Affero General Public License for more
+# details.
+#
+# You should have received a copy of the GNU Affero General Public License along
+# with this program. If not, see <http://www.gnu.org/licenses/>.
+#
+class AddRootAccountIdToAccessTokens < ActiveRecord::Migration[5.2]
+  include MigrationHelpers::AddColumnAndFk
+
+  tag :predeploy
+  disable_ddl_transaction!
+
+  def up
+    add_column_and_fk :access_tokens, :root_account_id, :accounts
+    add_index :access_tokens, :root_account_id, algorithm: :concurrently
+  end
+
+  def down
+    remove_column :access_tokens, :root_account_id
+  end
+end