feat: support column privilege diffs

[dilame]

What changed

Adds schema tracking and migration generation for column-level privileges.

• Fetches per-column ACLs from pg_attribute.attacl through a new GetColumnPrivileges query.
• Adds ColumnPrivilege and Table.ColumnPrivileges to the schema model.
• Generates GRANT/REVOKE SELECT|INSERT|UPDATE|REFERENCES (column) ON table statements for column ACL drift.
• Emits column grants after CREATE TABLE for new tables and after ADD COLUMN for new columns, ordered through SQL graph dependencies.
• Drops privileges together with their column, so a column removed from the target schema does not produce a REVOKE.
• Clears column privileges during plan validation, matching table privilege behavior, because privilege statements are skipped when temp DB roles do not exist.
• Column privileges on individual partitions are not implemented, matching the existing table privilege limitation.

Why

PostgreSQL stores column grants in pg_attribute.attacl, separate from the table ACL in pg_class.relacl. Before this change, pg-schema-diff did not model column ACLs, so a plan could omit GRANT ... (column) statements for new tables and new columns, and it could miss drift when a column grant was revoked. Both cases had to be patched by hand.

Validation

Ran the full test suite with PostgreSQL 17 server utilities and PostgreSQL 18 pg_dump for --restrict-key support:

go test ./...

New acceptance cases cover a new table with column grants, granting and revoking a column privilege, granting on a new column (asserting ADD COLUMN is ordered before GRANT), a grant on multiple columns, GRANT OPTION recreation, a non-public schema, and the partition not-implemented paths.