Fix GRANTED BY ordering in propagated REVOKE statements

[ibrahim halatci (ihalatci)]

Summary

• emit GRANTED BY before CASCADE/RESTRICT when deparsing propagated shared-object GRANT/REVOKE statements
• cover both RESTRICT and CASCADE with schema privilege propagation checks on coordinator and worker

Root cause

PostgreSQL grammar places GRANTED BY grantor before the optional CASCADE/RESTRICT behavior clause. AppendGrantSharedSuffix() emitted those clauses in the opposite order, producing worker SQL such as REVOKE ... RESTRICT GRANTED BY .... The coordinator completed its local revoke, while workers rejected the propagated command with a syntax error, leaving privileges inconsistent.

The role path already had the correct ordering (deparse_role_stmts.c), which is what makes this an oversight in the shared-object path rather than a deliberate difference.

Runtime negative control

With the one-line ordering change reverted and the harness re-run, the propagated statement is rejected by the worker:

 REVOKE USAGE ON SCHEMA granted_by_schema FROM role_2 GRANTED BY role_1 RESTRICT;
+ERROR:  syntax error at or near "GRANTED"
+CONTEXT:  while executing command on localhost:xxxxx
 REVOKE USAGE ON SCHEMA granted_by_schema FROM role_3 GRANTED BY role_1 CASCADE;
+ERROR:  syntax error at or near "GRANTED"

Because the worker rejects it, the whole REVOKE aborts and the privilege survives on both coordinator and worker. So unfixed, REVOKE ... GRANTED BY ... CASCADE|RESTRICT on a distributed shared object is not merely mis-ordered text — it is unexecutable. With the fix applied the same test passes with zero diff.

Cross-version validation

A single expected/grant_on_schema_propagation.out satisfies all supported majors — no version-specific variants were needed:

PostgreSQL	focused test
16.14	ok - grant_on_schema_propagation
17.10	ok - grant_on_schema_propagation
18.4	ok - grant_on_schema_propagation

Scope

This PR is limited to the shared-object deparser path (database, schema, function, sequence, and foreign server). Table grantor behavior is a separate defect with a separate fix and is intentionally out of scope here.
Tracks #8759.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 88.69%. Comparing base (3164f62) to head (f445a71).

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #8766   +/-   ##
=======================================
  Coverage   88.69%   88.69%           
=======================================
  Files         289      289           
  Lines       64889    64889           
  Branches     8180     8180           
=======================================
+ Hits        57553    57554    +1     
+ Misses       4973     4970    -3     
- Partials     2363     2365    +2     

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.