[Bug][Authz] `CREATE OR REPLACE` operation requires `ALTER` table privilege instead of `CREATE` table privilege when table exists

### Code of Conduct

- [X] I agree to follow this project's [Code of Conduct](https://www.apache.org/foundation/policies/conduct)

### Search before asking

- [X] I have searched in the [issues](https://github.com/apache/incubator-kyuubi/issues?q=is%3Aissue) and found no similar issues.

### Describe the bug

role A
```
CREATE VIEW default.view_tst(a, b) AS SELECT 1, 2;

DESC default.view_tst;

+---------+---------+----------+
| col_name|data_type| comment|
+---------+---------+----------+
| a| int| null|
| b| int| null|
+---------+---------+----------+

```

role B
```
CREATE OR REPLACE VIEW default.view_tst(c, d) AS SELECT 1, 2;
```

role A
```
DESC default.view_tst;

+---------+---------+----------+
| col_name|data_type| comment|
+---------+---------+----------+
| c| int| null|
| d| int| null|
+---------+---------+----------+
```

B has the permission to create tables in the default database, but does not have the permission to modify default.view_tst.
In fact, B can be modified successfully, indicating that there is a permission leak in the table of A

### Affects Version(s)

master

Reproduce the role A/role B SQL sequence for CREATE VIEW and CREATE OR REPLACE VIEW, focusing on the authorization entry point for existing views. Trace why replacement permits modification without ALTER privilege, then add regression coverage showing that CREATE is sufficient for the intended operation and that unauthorized modification is rejected.

Written by the indexing model from the issue text.