RPC parameters should be consistent w.r.t. permissions

[mathemancer]

Problem

We have a number of RPC functions that require privileges on a table to do their work. For example, records.list needs (at least) SELECT on at least one column of the table whose records it's listing to succeed. A number of parameters of that function (and similar functions) refer to columns. For example, filtering or ordering.

However, these parameters act differently w.r.t. privileges on specified columns. Some, for example order, just ignore any specified columns on which the user lacks SELECT privileges. Some others, for example filter, throw an exception if a column is specified for which the user lacks SELECT privileges.

This inconsistency is a bit confusing, and could lead to bugs.

Proposed solution

Specifying any column for which the user lacks SELECT on any parameter should result in a permissions-related exception.

Additional context

Record summaries may refer to columns for which a user lacks SELECT, and these should be silently ignored. This is because the user calling a function that uses summaries doesn't actually specify the summary, which is associated with the table, rather than the function call.

Filters absolutely must throw an error if the user doesn't have SELECT on a specified column. This is because we use filtering logic to define UPDATE and DELETE rows. This means that we can't really avoid at least a little inconsistency between summaries and filters w.r.t. behavior when missing SELECT for some columns.