release-23.1: sql: add CREATEROLE, CREATELOGIN, CREATEDB, and CONTROLJOB system privileges

[andyyang890]

Backport:

• 1/1 commits from "sql: refactor global privilege and legacy role option checking" (sql: refactor global privilege and legacy role option checking #109652)
• 1/1 commits from "privilege: automate generation of AllPrivileges list" (privilege: automate generation of AllPrivileges list #109776)
• 1/1 commits from "sql: add new CREATEROLE system privilege" (sql: add new CREATEROLE system privilege #109258)
• 1/1 commits from "privilege: automate generation of ByName map" (privilege: automate generation of ByName map #110088)
• 4/4 commits from "sql: add CREATELOGIN, CREATEDB, and CONTROLJOB system privileges" (sql: add CREATELOGIN, CREATEDB, and CONTROLJOB system privileges #110220)

Please see individual PRs for details.

/cc @cockroachdb/release

Release justification: Low risk, high benefit changes to existing functionality

[blathers-crl]

Thanks for opening a backport.

Please check the backport criteria before merging:

• Patches should only be created for serious issues or test-only changes.
• Patches should not break backwards-compatibility.
• Patches should change as little code as possible.
• Patches should not change on-disk formats or node communication protocols.
• Patches should not add new functionality.
• Patches must not add, edit, or otherwise modify cluster versions; or add version gates.

If some of the basic criteria cannot be satisfied, ensure that the exceptional criteria are satisfied within.

• There is a high priority need for the functionality that cannot wait until the next release and is difficult to address in another way.
• The new functionality is additive-only and only runs for clusters which have specifically “opted in” to it (e.g. by a cluster setting).
• New code is protected by a conditional check that is trivial to verify and ensures that it only runs for opt-in clusters.
• The PM and TL on the team that owns the changed code have signed off that the change obeys the above rules.

Add a brief release justification to the body of your PR to justify this backport.

Some other things to consider:

• What did we do to ensure that a user that doesn’t know & care about this backport, has no idea that it happened?
• Will this work in a cluster of mixed patch versions? Did we test that?
• If a user upgrades a patch version, uses this feature, and then downgrades, what happens?

[cockroach-teamcity]

This change is 

[andyyang890]

I've left a comment on every file that had a merge conflict during the manual backport. It seems to be a pretty clean and straightforward backport overall.

Reviewable status: complete! 0 of 0 LGTMs obtained (waiting on @adityamaru and @rafiss)

---

pkg/sql/crdb_internal.go line 2079 at r8 (raw file):

		for _, k := range settings.Keys(p.ExecCfg().Codec.ForSystemTenant()) {
			// If the user can only view sql.defaults settings, hide all other settings.
			if canViewSqlOnly && !strings.HasPrefix(k, "sql.defaults") {

Note: This file had a merge conflict. As far as I can tell, the only difference is that the type of k is string on release-23.1, while it is settings.InternalKey on master.

---

pkg/sql/grant_role.go line 71 at r8 (raw file):

	var err error
	if createRoleAllowsGrantRoleMembership.Get(&p.ExecCfg().Settings.SV) {
		allowedToGrantWithoutAdminOption, err = p.HasGlobalPrivilegeOrRoleOption(ctx, privilege.CREATEROLE)

Note: This file had a merge conflict since the createRoleAllowsGrantRoleMembership cluster setting doesn't exist on master anymore.

---

pkg/sql/revoke_role.go line 50 at r8 (raw file):

	var err error
	if createRoleAllowsGrantRoleMembership.Get(&p.ExecCfg().Settings.SV) {
		allowedToRevokeWithoutAdminOption, err = p.HasGlobalPrivilegeOrRoleOption(ctx, privilege.CREATEROLE)

Note: This file had a merge conflict since the createRoleAllowsGrantRoleMembership cluster setting doesn't exist on master anymore.

---

pkg/sql/set_cluster_setting.go line 66 at r8 (raw file):

}

func checkPrivilegesForSetting(ctx context.Context, p *planner, name string, action string) error {

Note: This file had a merge conflict. As far as I can tell, the only difference is that name has type string on release-23.1, while it has type settings.SettingName on master.

[rafiss]

thanks for the detailed notes! made it very easy to review

Reviewable status: complete! 0 of 0 LGTMs obtained (waiting on @adityamaru)