sql,storage: storage built-in functions are not available from secondary tenants

**Describe the problem**

Currently `crdb_internal.set_compaction_concurrency` and `compact_engine_span` are not available to secondary tenants.
(and the new `sstable_metrics` introduced by #104739)

In alignment with our multi-tenancy roadmap, we want them to be available to secondary tenants **with sufficient capabilities**.

Currently all the gRPC services that are part of the KV "PerStore" interface are not authorized by the RPC tenant interface.

**Expected behavior**

- We want to extend `rpc/auth_tenant.go` with rules that accept requests from the KV "PerStore" API.
- The requests should be allowed subject to a capability.
- The authz code should verify the range bounds to only allow requests that span a tenant's keyspace.
- There should be RU accounting for these request types.
- We also need to test the features actually work from a secondary tenant.

cc @RaduBerinde

Jira issue: CRDB-29115

Epic CRDB-39092