sql,tenantcapabilities: enforce span config bounds in secondary tenants

**Is your feature request related to a problem? Please describe.**
The spanconfigbounds subsystem is now enforced within kvserver for tenants which have them. These bounds do not make their way to the tenant pod, and do not get enforced. We should enforce these bounds when trying:
* to set zone configs (the code here should be updated to remove the restriction previously tracked by #75569), and
* to add regions to the tenant system database

**Describe the solution you'd like**
After a watcher for the span configs its way to the tenant, we should add a call to validate operations to write zone configs based on those span configs [here](https://github.com/cockroachdb/cockroach/blob/dec77b4a7677d2cbd94e53efc823b0404b77ef23/pkg/sql/set_zone_config.go#L1194) or maybe more likely [here](https://github.com/cockroachdb/cockroach/blob/dec77b4a7677d2cbd94e53efc823b0404b77ef23/pkg/sql/catalog/descs/collection.go#L504).

Pushing the dependency into the `descs.Collection` seems fine.

Also, when we determine whether we should be able add a region to the system database, we should consider the span config bounds. There's a few options on how to do that.
* One option would be to push the filtering of regions back to the host in [`TenantStatusServer.Regions`](https://github.com/cockroachdb/cockroach/blob/ebf9ac7f29f3f83e5896be46415a628a6c2e5f6f/pkg/server/serverpb/status.go#L83).
* Another would be to do it in the `regions.Provider` implementation.

Jira issue: CRDB-26620

Epic CRDB-26686

Start with pkg/sql/set_zone_config.go near the referenced line and pkg/sql/catalog/descs/collection.go near Collection validation. Then inspect TenantStatusServer.Regions in pkg/server/serverpb/status.go and the regions.Provider implementation to understand where secondary-tenant region filtering belongs. Done means span config bounds reach the tenant and are enforced for zone-config writes and adding regions to the tenant system database.

Written by the indexing model from the issue text.