server: gate the vmodule configuration knobs behind a tenant capability

The "vmodule" logging tunable impacts performance for the entire process. In this way, it resembles the ability to generate a CPU profile. For the same reason, we would like to limit its availability to secondary tenants unless they have sufficient capabilities.

There are 3 mechanisms to consider:

- the SQL built-in function `crdb_internal.set_vmodule`. This should only be callable if the calling tenant has sufficient capability.
- the cluster setting `server.debug.default_vmodule`. This should only be _applied_ (in server/server_sql.go) if the calling tenant has sufficient capability.
- the command line flag, read from the logging package. This does not need to be limited by a capability (it would be used by the operator for the entire process with mindfulness about impact)

Jira issue: CRDB-27387
Epic: CRDB-14482