Function upgrade_data_lake_schema_v11 

pub async fn upgrade_data_lake_schema_v11(
    tr: &mut Transaction<'_, Postgres>,
) -> Result<(), Error>

Upgrades the data lake schema to version 11. Adds a nullable allowed_cidrs TEXT[] column to both ingestion_api_keys and analytics_api_keys: the CIDR ranges/bare IPs a key may be presented from. No backfill needed (unlike audience, which had to become NOT NULL): NULL/absent means “no restriction”, which is exactly the correct value for every pre-existing row.