sql: decouple RLS policies from Check/CheckCount APIs

In 25.1, when row-level security (RLS) support was introduced, write-time enforcement was implemented by generating a synthetic check constraint in the optbuilder and during execution. This issue proposes decoupling RLS enforcement from the Check API on the optbuilder side.

While the current approach appears to function correctly, it relies on subtle implementation details that make the code brittle and prone to future breakage. There are concerns that misusing the Check API—which is intended for static table constraints—could eventually lead to incorrect query plans. Additionally, the current method is not as efficient as it could be: RLS expressions are first constructed as strings and then converted into scalar expressions, which introduces unnecessary overhead and complexity.

For more context and a helpful summary, see Marcus’ comment here:
https://github.com/cockroachdb/cockroach/pull/143587#pullrequestreview-2758849760

Jira issue: CRDB-49315

Epic CRDB-52152