Allow setting a network policy for tenant global

[flaneur2020]

Summary

at the moment, network policy is bound to user, but in enterprise scenario, there's also need to have setting a global network policy, to restrict only arbitrary IP segments can access the query service.

like:

SET GLOBAL NETWORK_POLICY = 'mypolicy'; // set the policy
SET GLOBAL NETWORK_POLICY = '';         // unset the policy

we should only allow account_admin to edit global network policy in the tenant.

also, we could consider to allow the users with account_admin bypass the network policies, to have a way to recover themselves from being blocked by misconfigured network policies.