sql: add guardrail to prevent txn use after error within internal executor

(Credit to @jeffswenson and @msbutler for pointing this out.)

When a user transaction encounters a non-retryable error, the conn fsm state machine transitions to aborted, which prevents any further use of the transaction unless the user rolls back to a savepoint from before the error. (As of #140160 we abort the transaction eagerly when there's no savepoint.)

There's currently no equivalent state transition performed by the internal executor. If the internal executor is passed an open transaction, and then encounters an error, it is up to the caller to abort the transaction (or poison it within the conn executor state machine).

There's also no savepoint created by internal executor, so if the caller wants to continue using the transaction after an error, the caller must have created a savepoint and must then rollback to that savepoint.

It's easy to get this pattern wrong, and assume that the transaction passed to internal executor can continue to be used after an error. We should (a) somehow poison the transaction so it's impossible to re-use after internal executor encounters an error and/or (b) use a savepoint within internal executor to return the transaction to an open state after encountering an error.

Jira issue: CRDB-53144