feat(query):masking policy support rbac

[TCeason]

I hereby agree to the terms of the CLA available at: https://docs.databend.com/dev/policies/cla/

Summary

• Added CREATE/APPLY MASKING POLICY privilege; GRANT/REVOKE/SHOW now accept masking policies and resolve them to policy IDs.
  • Enforce APPLY/OWNERSHIP when SET/UNSET column masking policies and when DROP/DESC masking policies.
  • Added ID↔name mapping for masking/row access policies; create/drop masking policy auto grants/revokes ownership to the current role.
  • Visibility/SHOW GRANTS now covers masking policies via APPLY/OWNERSHIP; added proto compatibility case and RBAC E2E for masking policy.

Tests

• Unit Test
• Logic Test
• Benchmark Test
• No Test - Explain why

Type of change

• Bug Fix (non-breaking change which fixes an issue)
• New Feature (non-breaking change which adds functionality)
• Breaking Change (fix or feature that could cause existing functionality not to work as expected)
• Documentation Update
• Refactoring
• Performance Improvement
• Other (please describe):

---

This change is 

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[drmingdrmer]

@drmingdrmer reviewed 8 of 43 files at r1, 2 of 3 files at r2, all commit messages.
Reviewable status: 10 of 43 files reviewed, 3 unresolved discussions

---

src/meta/app/src/data_mask/data_mask_id_to_name_ident.rs line 48 at r2 (raw file):

        const PREFIX: &'static str = "__fd_datamask_id_to_name";
        const TYPE: &'static str = "DataMaskIdToNameIdent";
        const HAS_TENANT: bool = false;

add tenant to the key for all keys if possible in future. For better export/import support

---

src/meta/api/src/data_mask_api.rs line 54 at r2 (raw file):

        &self,
        name_ident: &DataMaskNameIdent,
    ) -> Result<Option<u64>, MetaError>;

Using SeqV<_> would be better

---

src/meta/api/src/data_mask_api.rs line 60 at r2 (raw file):

        tenant: &Tenant,
        policy_id: u64,
    ) -> Result<Option<String>, MetaError>;

Use SeqV

[drmingdrmer]

@drmingdrmer reviewed 8 of 43 files at r1, 5 of 11 files at r3, 1 of 2 files at r4, 2 of 2 files at r5, all commit messages.
Reviewable status: 23 of 43 files reviewed, all discussions resolved