In the op observer after being assigned an OpTime (e.g., where this happens for inserts), writes should get the MigratingTenantAccessBlocker for the database they're in from the MigratingTenantAccessBlockerByPrefix and call checkIfCanWriteOrThrow on it.

Note that this should be done in all op observers for user writes, e.g. includes things like collMod, createIndex, and drop.

Test that this works by calling donorStartMigration to put the database's MigratingTenantAccessBlocker into blockWrites and confirming that all writes throw TenantMigrationConflict. (After the migrationConflictRetry loop is added in SERVER-49181, this test will have to be modified to, e.g., send the writes with maxTimeMS and assert that they throw MaxTimeMSExpired.)