`GRANT OPTION` is not tested

[steve-chavez]

Problem

GRANT OPTION is not tested on vault tests and some others:

postgres/nix/tests/expected/vault.out

Lines 28 to 37 in f670f7d

	schema | object_name | grantee | privilege_type
	--------+---------------------------+----------------+----------------
	vault | _crypto_aead_det_decrypt | postgres | EXECUTE
	vault | _crypto_aead_det_decrypt | supabase_admin | EXECUTE
	vault | _crypto_aead_det_encrypt | supabase_admin | EXECUTE
	vault | _crypto_aead_det_noncegen | supabase_admin | EXECUTE
	vault | create_secret | postgres | EXECUTE
	vault | create_secret | supabase_admin | EXECUTE
	vault | decrypted_secrets | postgres | DELETE
	vault | decrypted_secrets | postgres | SELECT

For reference, GRANT OPTION is added like

grant select, delete, truncate, references on vault.secrets, vault.decrypted_secrets to postgres
with grant option;

Not testing this can cause regressions.

Solution

Add GRANT OPTION to all db object privilege tests.

[brainrake]

Partial progress since this was filed: 4a08f05a added is_grantable checks for auth and storage objects (auth.sql:41, storage.sql:41).

Still missing: vault.sql:15 and vault.sql:26 use aclexplode without asserting is_grantable, and the other db-object privilege tests don't cover it either. Keeping open for extending coverage to all privilege tests.