privilege: fix privilege check of CREATE ROLE and DROP ROLE

[imtbkcat]

What problem does this PR solve?

In MySQL, user with CREATE USER privilege can execute CREATE ROLE xxx or DROP ROLE xxx. But TiDB has bug on this check.

mysql> show grants;
+------------------------------------------+
| Grants for User                          |
+------------------------------------------+
| GRANT Create User ON *.* TO 'tester'@'%' |
+------------------------------------------+
1 row in set (0.00 sec)

mysql> create role r4;
ERROR 1227 (42000): Access denied; you need (at least one of) the CREATE ROLE privilege(s) for this operation
mysql> drop role r1;
ERROR 1227 (42000): Access denied; you need (at least one of) the DROP ROLE privilege(s) for this operation
mysql>

What is changed and how it works?

Add check for CREATE USER privilege. If users have CREATE USER privilege, they can CREATE ROLE and DROP ROLE

Check List

Tests

• Unit test

Code changes

• None

Side effects

• Increased code complexity

Related changes

• Need to cherry-pick to the release branch

Release note

• fix bug of privilege check on CREATE ROLE

[tiancaiamao]

LGTM

[tiancaiamao]

Here is &&, that means if a user has the CreateUser privilege or DropRole privilege, he can execute the drop role operation.

[imtbkcat]

right, if a user has the CreateUser privilege or DropRole privilege, the can execute the drop role operation.

[jackysp]

LGTM

[jackysp]

/merge

[sre-bot]

/run-all-tests

[codecov]

Codecov Report

Merging #13940 into master will not change coverage.
The diff coverage is n/a.

@@             Coverage Diff             @@
##             master     #13940   +/-   ##
===========================================
  Coverage   80.2117%   80.2117%           
===========================================
  Files           482        482           
  Lines        120885     120885           
===========================================
  Hits          96964      96964           
  Misses        16192      16192           
  Partials       7729       7729

[sre-bot]

@imtbkcat merge failed.

[jackysp]

/run-unit-test

[imtbkcat]

/run-unit-test

[jackysp]

/merge

[sre-bot]

/run-all-tests

[sre-bot]

cherry pick to release-3.0 failed