Disable non-RLS table from public API by default

[tonyxiao]

It seems really strange that the default behavior without RLS enabled is "free for all" where everyone can do everything. This is very counter-intuitive and bad security practice, especially in case where a table gets created without a developer explicitly doing so (e.g. migrations table). Cab we prevent tables without RLS from showing up in the public API at all? If it's already possible of course I'd love to know.