Task LAV-2685: REST /api/v2 users, roles and database roles (object surface only, no grants) (#3231)

* task LAV-2685: WIP — commit stranded agent work

* Task LAV-2685: REST /api/v2 users, roles and database roles

Complete the RBAC object surface (list/create/fetch/delete/createOrAlter/
clone/tag trio) for users, roles and database roles via the generic REST
registry, with snapshots captured against real Snowflake. Grants stay 501.

- Parser: route ALTER USER SET/UNSET TAG through the shared object-tag
  interceptor (Statement::SetTags) so a qualified tag key parses, which the
  generic parse_alter_user grammar cannot. Exclude Snowflake from the
  cross-dialect ALTER USER tag assertions and cover it in the Snowflake suite,
  mirroring the ALTER ROLE precedent.
- Projection fixes (real-Snowflake parity): map SHOW USERS'
  default_secondary_roles (["ALL"]) to the scalar REST enum; treat the
  V1-wire "1" boolean as truthy so has_password/has_rsa_public_key report
  correctly; render a database role's empty comment as "" (not null); a clone
  does not inherit its source's comment.
- error_ident: users and roles lower-case the echoed identifier in the
  002003 envelope (databases/warehouses stay verbatim), matching capture.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

Author: hovaesco

src/ast/mod.rs

@@ -4147,6 +4147,9 @@ pub enum Statement {
         name: ObjectName,
         /// Optional `COMMENT = '...'` clause.
         comment: Option<String>,
+        /// Optional `CLONE <source>` clause: the (optionally database-qualified)
+        /// source database role this one is cloned from.
+        clone: Option<ObjectName>,
     },
     /// ```sql
     /// CREATE SECRET
@@ -7823,13 +7826,17 @@ impl fmt::Display for Statement {
                 if_not_exists,
                 name,
                 comment,
+                clone,
             } => {
                 write!(
                     f,
                     "CREATE {or_replace}DATABASE ROLE {if_not_exists}{name}",
                     or_replace = if *or_replace { "OR REPLACE " } else { "" },
                     if_not_exists = if *if_not_exists { "IF NOT EXISTS " } else { "" },
                 )?;
+                if let Some(clone) = clone {
+                    write!(f, " CLONE {clone}")?;
+                }
                 if let Some(comment) = comment {
                     write!(
                         f,