multi-tenant, c2c: revert tenant to timestamp

**Is your feature request related to a problem? Please describe.**

Users have expressed an interest in “disaster recovery” for user errors. This might be things like regrettable DROP, TRUNCATE, schema changes...

**Describe the solution you'd like**

The ability to reset a cluster back to a timestamp prior to a regrettable error.

This seems like a good fit for the TENANT abstraction. We are implementing the required logic for C2C failover, and perhaps it can be applied to this use case.

It’s likely more difficult to achieve this for a traditional (non-multi-tenant) cluster, and the future is multi-tenant in any case.

**Describe alternatives you've considered**

Our upcoming C2C feature offers this ability, but requires failing over to a separate cluster. This is more complex, as infra and app logic is part of the failover (think updating connection strings or redirecting load balancers). Further, C2C requires twice the hardware, and is an ongoing load on a source cluster.

Restore `AS OF SYSTEM TIME` can serve this purpose, but the RTO is much longer.

Jira issue: CRDB-28637