Description

Running the database schema migration automatically on every startup is problematic for different reasons:

1. Applications often don't get permissions to run DDL statements (CREATE, ALTER, TRUNCATE, ...) during day-to-day operation, but only DML statements (SELECT, INSERT, UPDATE, ...)
2. Running the schema migration unknowingly could result in a long downtime in case something goes wrong and the user didn't expect a migration to happen at all.

Proposal

For these reasons I propose the following changes:

1. The Ledger API Server only validates the database schema on startup and reports any validation errors.
2. The Ledger API Server only runs schema migrations when a particular flag is passed.

Questions

1. Should this behavior only be applied to the Ledger API Server or also to DAML-on-SQL? If yes, only the persistent variety? (it is always safe to run schema migration on an in-memory H2, for example)