[Subtask] Integrate policy-to-tag relation updates with endpoint OCC

### Describe the subtask

Track the endpoint lifecycle fencing deferred from #12579.

`PolicyTagRelService.updateRelations` currently serializes updates by locking the Tag row and uses CAS for relation-row deletion, but it does not lock or CAS-fence every affected Policy endpoint. A Policy may therefore be modified or deleted concurrently while the relation transaction is validating or writing associations.

- Reuse the metadata OCC token introduced by #12347 instead of directly incrementing the Policy `current_version`.
- Validate and fence the live Tag and every affected Policy inside the relation transaction.
- Apply relation-row CAS writes only after the endpoints have been fenced.
- Ensure a zero-row endpoint or relation CAS rolls back the complete relation update.
- Add concurrency tests for H2, MySQL, and PostgreSQL.

### Parent issue

https://github.com/apache/gravitino/issues/12347

Start with PolicyTagRelService.updateRelations and the metadata OCC token introduced by #12347. Trace how the live Tag and affected Policy endpoints are validated and fenced before relation writes, then add concurrency coverage for H2, MySQL, and PostgreSQL; done means endpoint or relation CAS failures roll back the complete update.

Written by the indexing model from the issue text.