[Feature] Add RBAC for AI functions and providers

Feature request

Is your feature request related to a problem? Please describe.

The AI functions and AI Provider integration merged in #78807 defer invocation privileges to a separate RBAC change. Administrators need to restrict AI-function execution and access to individual model services independently of Provider management privileges.

Describe the solution you'd like

• Support global AI-function usage or per-function-family USAGE, with additional USAGE on the selected AI Provider for named-provider calls.
• Reuse the existing authorization framework, user and role grants, group-role mappings, journal and image persistence, and Provider UUID identity. Dropping and recreating a Provider with the same name must not restore its previous grants.
• Enforce the privileges for queries, DML, views, prepared execution, and user-submitted AI tasks. AI tasks must run with an authenticated creator and current permissions, without falling back to root when that identity cannot be restored.
• Document grant syntax, upgrade requirements, and execution boundaries. Preserve the existing SYSTEM routing and Provider management privileges.

Describe alternatives you've considered

Using SYSTEM OPERATE for invocation would also grant Provider management capabilities. Ordinary table/view privileges alone cannot restrict which external model service a user may invoke.

Additional context

This is the focused authorization follow-up to #78807 and #78839, related to the broader AI roadmap in #60002. It does not introduce AI Resource/AI Model metadata, change model routing, or add Token Admission.