Describe the problem

For illustration, consider:

The API used here, ForEachTableDesc filters out descriptors that the user doesn't have visibility to (per privileges/ownership). This opens us up to a scenario where a user may add a region to a database but not modify all of the tables that exist inside the database with the default locality config. Later, when such a table is accessed, it will fail validation as we explicitly ensure all tables inside a MR database have a locality config set on them.

Expected behavior
In the illustration above, adding a region should fail if the user doesn't have permissions to modify all of the tables inside the database. Separately, the choice of API (ForEachTableDesc) is completely wrong here.

Additional context
This issue also manifests itself when we repartition Regional By Table tables when adding/dropping subsequent regions (albeit slightly differently).