feat(query): Add SecureFilter for Row Access Policies and Stats Privacy

[TCeason]

I hereby agree to the terms of the CLA available at: https://docs.databend.com/dev/policies/cla/

Summary

This PR add Plan::SecureFilter, a new operator that automatically applies row access policies defined in table metadata.

1. Policy Enforcement: During query binding, if a table has a row_access_policy, a SecureFilter is automatically inserted directly above the table's Scan operator. This ensures the policy is applied early and specifically to that table.
2. Stats Privacy: For SecureFilter, the optimizer will hide column-level statistics (e.g., histograms, NDV). This prevents accidental leakage of sensitive data patterns, even during query planning.
3. Scoped Application: SecureFilter is marked as non-movable; optimizer rules will not push it above joins or merge it into generic filters. This guarantees the policy stays tied to its specific table.
4. Runtime Filtering: At execution, SecureFilter evaluates its policy expression for each row, filtering out non-compliant rows, similar to a regular Filter.

Note:

Need to disable enable_planner_cache. Because stmt maybe same but table meta is different(add or drop a row access policy).

Tests

• Unit Test
• Logic Test
• Benchmark Test
• No Test - Explain why

Type of change

• Bug Fix (non-breaking change which fixes an issue)
• New Feature (non-breaking change which adds functionality)
• Breaking Change (fix or feature that could cause existing functionality not to work as expected)
• Documentation Update
• Refactoring
• Performance Improvement
• Other (please describe):

---

This change is