[splinter] Proposal: two INFO lints for grant/policy mismatch (privilege_without_policy, policy_without_privilege)

With the Data API change (discussion #45329, applied to all projects on 2026-10-30), grants become explicit. Two mismatches between grants and RLS policies then become worth surfacing: 1. privilege_without_policy — RLS is enabled, anon/authenticated hold a table privilege (SELECT/INSERT/UPDATE/DELETE, or TRUNCATE which RLS doesn't cover), but no permissive policy allows that command for that role. RLS still blocks the rows, so nothing leaks today; the grant is just wider than the policies need. Proposed level: INFO (same reasoning as 0008). 2. policy_without_privilege — a permissive policy exists for a role/command, but the role has no table (or column) privilege. The policy is dead code and requests fail with 42501 before it is evaluated. Expected to become common after Oct 30. Proposed level: INFO. How this differs from 0026/0027: those flag relations a role can read (introspection exposure). These compare the grant set against the policy set per role and command, in b…