DROP TENANT is an extremely destructive command. In the unified architecture world, it could be effectively equivalent to deleting a cluster's worth of data. As a result, users should not be entering into it lightly. To signal that care should be taken in its use we should somehow protect against misuse (cluster/session setting, sql_safe_updates, etc).

In this same issue, we may also consider gating CREATE TENANT so that we don't over-expose the tenant architecture to unsuspecting customers.

Epic: CRDB-23559

Jira issue: CRDB-24996