Describe the problem

References #85954.

Once tenant capabilities are in effect, secondary tenants will be able to issue admin operations such as splits. If a tenant is trying to issue an operation for which it doesn't have the right capabilities, it will get an auth error. Ideally, the tenant should only issue the operation if it has the right capabilities. As such, we should perform a capability check in the SQL layer, instead of relying on the Auth code to bubble up errors.

The origin of the error (auth vs. SQL) isn't particularly meaningful for admin operations such as splits. However, once we expand capabilities to include span configurations as well, it'll become important -- we don't want tenants committing zone configuration changes that cannot be reconciled because they don't have the correct capabilities.

We should add a CapabilityChecker interface, and implement it via the Connector, that allows secondary tenants to query the status of their tenant capabilities.

Jira issue: CRDB-23566