fix(frontend): keep DDL ownership on matche role

[ouyuanning]

What type of PR is this?

• API-change
• BUG
• Improvement
• Documentation
• Feature
• Test and CI
• Code Refactoring

Which issue(s) this PR fixes:

issue #24956

What this PR does / why we need it:

This PR fixes DDL ownership handling when privileges are satisfied by secondary roles or inherited roles.

• Track the matched privilege role during authorization and use it as the DDL owner for CREATE DATABASE / CREATE TABLE.
• Map inherited privilege matches back to the active root role so ownership follows the active granted role, not the inherited leaf role.
• Re-authenticate prepared CREATE DATABASE / CREATE TABLE during EXECUTE so prepared DDL also sets the owner role correctly.
• Revoke implicit ownership privileges from the actual object owner role when dropping databases/tables, including multi-table drops.
• Add unit tests and BVT coverage for secondary-role DDL ownership and prepared DDL ownership cleanup.

Validation:

• go test -mod=mod ./pkg/defines -count=1
• go test -mod=mod ./pkg/frontend -run 'TestCreateDatabaseOwnerRoleFollowsActiveInheritedRoleRoot|TestCreateTableOwnerRoleFollowsPrivilegeRole|Test_determineUserHasPrivilegeSet' -count=1 was blocked locally by missing xxhash.h before running tests.

[qodo-code-review]

Qodo reviews are paused for this user.

Troubleshooting steps vary by plan Learn more →

On a Teams plan?
Reviews resume once this user has a paid seat and their Git account is linked in Qodo.
Link Git account →

Using GitHub Enterprise Server, GitLab Self-Managed, or Bitbucket Data Center?
These require an Enterprise plan - Contact us
Contact us →