MDEV-14443 DENY statement

[vaintroub]

Implements a DENY statement. A DENY explicitly forbids a privilege regardless of any GRANTs at the same or higher scope.

The syntax of DENY is exactly the same as for GRANT (the type of grant that deals with privileges), only the verb needs to be changed (i.e DENY instead of GRANT).

DENYs can be revoked with special "REVOKE DENY" statement, which is analog to "REVOKE" for grants.

Example:

DENY SELECT ON db.table TO 'user'@'host';
REVOKE DENY SELECT ON db.table FROM 'user'@'host';

Roles incl PUBLIC support DENY, the semantics are such that DENY from roles are merged with existing privileges, meaning that both current role's and PUBLIC's DENY apply during various privilege checks.

Implementation notes

privilege_t → access_t

The core change is widening the privilege type from a single bitmask to access_t, which carries three fields: m_allow_bits, m_deny_bits, and m_deny_subtree (summary of denies from lower scopes). operator& and operator~ are overloaded so that existing privilege-check patterns work mostly unchanged; deny bits are simply sticky and propagate through the hierarchy. operator|= and operator=(privilege_t) are deleted to force explicit use of merge_same_level() (roles/PUBLIC) or merge_with_parent() (global→db→table→column).

Storage

DENY entries for all scopes are stored as a "denies" JSON array in the user's existing mysql.global_priv row. On DENY / REVOKE DENY the array is rewritten in-place; REVOKE ALL,GRANT OPTION ON *.* clears it entirely.

Cache injection

At server start / FLUSH PRIVILEGES, deny entries are loaded in a second pass over mysql.global_priv in grant_load (skipped entirely when no denies exist) and injected into the in-memory ACL_USER/ACL_DB/GRANT_TABLE / GRANT_NAME caches. Online DENY updates only the affected cache entry; online REVOKE DENY fully rebuilds the user's deny state from JSON.

SHOW GRANTS behavior

Privileged users (with SELECT privilege to mysql.* ) will see own and other's DENY entries in SHOW GRANTS output. Currently there is no way for non-privileged users to see own DENYs.