privileges,planner: implement checks for RESTRICTED_USER_ADMIN for granting privileges and roles

[YangKeao]

What problem does this PR solve?

Issue Number: close #64295

Problem Summary:

The current implementation of SEM is not good enough (for both v1 and v2). We'll need to restrict the granting and revoking of roles which have RESTRICTED_USER_ADMIN, or the user with ROLE ADMIN permission can easy take the higher privilege.

What changed and how does it work?

1. Users with RESTRICTED_USER_ADMIN are not allowed to be deleted
2. Users with RESTRICTED_USER_ADMIN are not allowed to have their names modified
3. Users with the RESTRICTED_USER_ADMIN permission are not allowed to change permissions.
4. An user with the RESTRICTED_USER_ADMIN attribute is not allowed to be used as a role.

Users with RESTRICTED_USER_ADMIN are not limited by these four rules.

Check List

Tests

• Unit test
• Integration test
• Manual test (add detailed scripts or steps below)
• No need to test

  • I checked and no code files have been changed.

Side effects

• Performance regression: Consumes more CPU
• Performance regression: Consumes more Memory
• Breaking backward compatibility

Documentation

• Affects user behaviors
• Contains syntax changes
• Contains variable changes
• Contains experimental features
• Changes MySQL compatibility

Release note

None

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 74.8328%. Comparing base (16e461a) to head (6106556).
⚠️ Report is 575 commits behind head on master.

Additional details and impacted files

@@               Coverage Diff                @@
##             master     #64297        +/-   ##
================================================
+ Coverage   72.7524%   74.8328%   +2.0804%     
================================================
  Files          1859       1867         +8     
  Lines        504107     522478     +18371     
================================================
+ Hits         366750     390985     +24235     
+ Misses       115098     109718      -5380     
+ Partials      22259      21775       -484     

Flag	Coverage Δ
integration	43.2433% <100.0000%> (?)
unit	74.0782% <100.0000%> (+1.7514%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Components	Coverage Δ
dumpling	52.8700% <ø> (ø)
parser	∅ <ø> (∅)
br	47.7263% <ø> (+1.3652%)	⬆️

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[xhebox]

/retest

[ti-chi-bot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: hawkingrei, xhebox

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [hawkingrei,xhebox]
• pkg/planner/OWNERS [hawkingrei]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[ti-chi-bot]

[LGTM Timeline notifier]

Timeline:

• 2025-11-06 03:18:48.784328446 +0000 UTC m=+326578.227358324: ☑️ agreed by xhebox.
• 2025-11-12 07:54:58.790528123 +0000 UTC m=+861548.233558002: ☑️ agreed by hawkingrei.

[hawkingrei]

/retest

[ti-chi-bot]

In response to a cherrypick label: new pull request created to branch release-7.1: #66646.
But this PR has conflicts, please resolve them!

[ti-chi-bot]

In response to a cherrypick label: new pull request created to branch release-8.1: #66647.
But this PR has conflicts, please resolve them!

[ti-chi-bot]

In response to a cherrypick label: new pull request created to branch release-7.5: #66648.
But this PR has conflicts, please resolve them!

[ti-chi-bot]

In response to a cherrypick label: new pull request created to branch release-8.5: #66649.
But this PR has conflicts, please resolve them!

[ti-chi-bot]

In response to a cherrypick label: new pull request created to branch release-6.5: #66712.
But this PR has conflicts, please resolve them!