Function check_restrict_to_user_objects

src/sql/src/rbac.rs:327–353

When `restrict_to_user_objects` is active, rejects access to system catalog objects. Functions and types are allowed through because they are needed for query execution. All other system items (tables, views, sources, sinks, etc.) are blocked. This is an allow-list — new catalog item types are blocked by default. See: doc/developer/design/20260508_restrict_to_user_objects.md

(
    catalog: &impl SessionCatalog,
    session: &dyn SessionMetadata,
    resolved_ids: &ResolvedIds,
)

///
/// See: doc/developer/design/20260508_restrict_to_user_objects.md
fn check_restrict_to_user_objects(
    catalog: &impl SessionCatalog,
    session: &dyn SessionMetadata,
    resolved_ids: &ResolvedIds,
) -> Result<(), UnauthorizedError> {
    if !session.restrict_to_user_objects() {
        return Ok(());
    }
    for item_id in resolved_ids.items() {
        if item_id.is_system() {
            if let Some(item) = catalog.try_get_item(item_id) {
                match item.item_type() {
                    CatalogItemType::Func | CatalogItemType::Type => {}
                    _ => {
                        if RESTRICT_TO_USER_OBJECTS_ALLOWED_OIDS.contains(&item.oid()) {
                            continue;
                        }
                        return Err(UnauthorizedError::RestrictedSystemObject {
                            object_name: item.name().item.clone(),
                        });
                    }
                }
            }
        }
    }
    Ok(())
}

/// Checks if a `session` is authorized to use `resolved_ids`. If not, an error is returned.
pub fn check_usage(