LAV-3920: Match workspace and restricted-session grant selectors (#4457)

Recognize both plural selector types in the existing bulk grant grammar.
Reuse empty-ALL and future-definition machinery without adding catalogs or
metadata projections. Reject FUTURE RESTRICTED SESSION SCOPES with the exact
000002 (0A000) unsupported-feature response for both GRANT and REVOKE.

Capture all eight selector/container/type combinations against Snowflake
Cloud. Confirm restricted-session results on the Enterprise account as well:
ALL is an empty no-op and FUTURE is rejected on both accounts. Each case
snapshots full statuses/errors and ordinary/container-future/role-future
metadata before GRANT, after GRANT, and after REVOKE. Future workspace READ
round-trips through both metadata views and is removed by REVOKE; rejected
restricted-session grants leave all views empty.

Verification:
- Before implementation: all eight new replay tests failed on syntax errors.
- make check passed.
- Focused make test-compat replay passed all 43 tests across
  test_grant_workspace_session_selectors.py, test_grant_new_object_kinds.py,
  and test_future_grants.py. Existing snapshots are unchanged.

Co-authored-by: Sabir Akhadov <sabir.akhadov@localstack.cloud>
## Test matrix

WORKSPACES READ / ALL DATABASE / empty GRANT+REVOKE, no edges -> tests/queries/access_control/test_grant_workspace_session_selectors.py::test_grant_workspace_session_selectors[ALL-DATABASE-WORKSPACES-READ]
WORKSPACES READ / ALL SCHEMA / empty GRANT+REVOKE, no edges -> tests/queries/access_control/test_grant_workspace_session_selectors.py::test_grant_workspace_session_selectors[ALL-SCHEMA-WORKSPACES-READ]
WORKSPACES READ / FUTURE DATABASE / GRANT metadata round-trip+REVOKE removal -> tests/queries/access_control/test_grant_workspace_session_selectors.py::test_grant_workspace_session_selectors[FUTURE-DATABASE-WORKSPACES-READ]
WORKSPACES READ / FUTURE SCHEMA / GRANT metadata round-trip+REVOKE removal -> tests/queries/access_control/test_grant_workspace_session_selectors.py::test_grant_workspace_session_selectors[FUTURE-SCHEMA-WORKSPACES-READ]
RESTRICTED SESSION SCOPES USAGE / ALL DATABASE / empty GRANT+REVOKE, no edges -> tests/queries/access_control/test_grant_workspace_session_selectors.py::test_grant_workspace_session_selectors[ALL-DATABASE-RESTRICTED SESSION SCOPES-USAGE]
RESTRICTED SESSION SCOPES USAGE / ALL SCHEMA / empty GRANT+REVOKE, no edges -> tests/queries/access_control/test_grant_workspace_session_selectors.py::test_grant_workspace_session_selectors[ALL-SCHEMA-RESTRICTED SESSION SCOPES-USAGE]
RESTRICTED SESSION SCOPES USAGE / FUTURE DATABASE / exact GRANT+REVOKE rejection, no edges -> tests/queries/access_control/test_grant_workspace_session_selectors.py::test_grant_workspace_session_selectors[FUTURE-DATABASE-RESTRICTED SESSION SCOPES-USAGE]
RESTRICTED SESSION SCOPES USAGE / FUTURE SCHEMA / exact GRANT+REVOKE rejection, no edges -> tests/queries/access_control/test_grant_workspace_session_selectors.py::test_grant_workspace_session_selectors[FUTURE-SCHEMA-RESTRICTED SESSION SCOPES-USAGE]
Existing ordinary empty-ALL / new object kinds -> tests/queries/access_control/test_grant_new_object_kinds.py::test_all_grant_new_kind_in_schema
Existing future definitions / roles -> tests/queries/access_control/test_grant_new_object_kinds.py::test_future_grant_new_kind_to_role
Existing future definitions / database roles -> tests/queries/access_control/test_grant_new_object_kinds.py::test_future_grant_new_kind_to_database_role
Existing future grants / revoke persistence boundary -> tests/queries/access_control/test_future_grants.py::test_revoke_future_stops_new_keeps_existing

Co-authored-by: spiral <spiral@localhost>
Co-authored-by: Sabir Akhadov <sabir.akhadov@localstack.cloud>

Author: 3 people

src/parser/mod.rs

@@ -20801,6 +20801,8 @@ impl<'a> Parser<'a> {
         ("NOTEBOOKS", &["NOTEBOOKS"], "NOTEBOOK"),
         ("TYPES", &["TYPES"], "TYPE"),
         ("DATA METRIC FUNCTIONS", &["DATA", "METRIC", "FUNCTIONS"], "FUNCTION"),
+        ("WORKSPACES", &["WORKSPACES"], "WORKSPACE"),
+        ("RESTRICTED SESSION SCOPES", &["RESTRICTED", "SESSION", "SCOPES"], "RESTRICTED_SESSION_SCOPE"),
     ];
 
     /// `ON {ALL|FUTURE} <plural-kind> IN {SCHEMA|DATABASE} <name>[, …]` for the