Identified by @bdarnell in this comment

Today, we have certain places in the code that directly call a Go RPC handler method inside the server package, without actually issuing a RPC call. This bypasses authentication and may thus bypass authorization.

We need to audit these calls to see what to do about them.

In an ideal world:

• none of the RPC handler methods should be usable from another package. This can be achieved by moving their implementation in a new sub-package server/internal

• internal logic should be equipped with adequate authorization barriers.

Jira issue: CRDB-8791