Non-deterministic subqueries in DML on reference table should not be pushed down

We liberally push down DML commands on reference tables with subqueries that may return different results on different replicas (e.g. limit without order by).
```
update ref set b = 1 where a in (select a from ref where b <> 1 limit 5);
```

This could cause replicas to diverge. We should reject these queries in the router planner and then let them go through recursive planning to get consistent results on all replicas, like we already do when there is a volatile function.

For non-deterministic correlated subqueries, we should probably error out (perhaps allow them with citus.subquery_pushdown).

Start in the router planner and compare handling of non-deterministic subqueries with the existing volatile-function path. Reproduce the reference-table UPDATE example, then verify that unsafe uncorrelated subqueries avoid pushdown and that correlated cases follow the intended error or configuration behavior.

Written by the indexing model from the issue text.