sql: remove the inert system.join_tokens table

`system.join_tokens` backed the join-token exchange behind the `cockroach connect` command, which was never shipped as a real feature. The exchange was deprecated in 23.2 and 24.1 removed its last users: the `crdb_internal.create_join_token` builtin that wrote rows, and the node-join RPC handler that read them. The remaining generator code (`security.GenerateJoinToken`, the `JoinToken` type, and the `eval.JoinTokenCreator` interface) has since been removed as well.

The table itself is still bootstrapped into every new cluster and still carries `keys.JoinTokensTableID = 41`, but no supported binary reads or writes it. It should be retired.

**Why this wasn't done alongside the code removal:** dropping a bootstrapped
system table is not a delete — it needs
- a cluster version gate,
- an upgrade migration that drops the table on existing clusters,
- removal from the bootstrap descriptor set, with regenerated bootstrap golden
files (`pkg/sql/catalog/bootstrap`),
- and a decision on how `RESTORE` of an older backup that contains the table
should behave.

`keys.JoinTokensTableID` must stay burnt either way — descriptor IDs in the
reserved range are never reused.

**Touch points:**
- `pkg/sql/catalog/systemschema/system.go` — `JoinTokensTableSchema` and the
`JoinTokensTable` descriptor (a TODO pointing at this issue lives here)
- `pkg/sql/catalog/bootstrap/metadata.go` — `AddDescriptor(JoinTokensTable)`
- `pkg/keys/constants.go` — `JoinTokensTableID`
- `pkg/sql/sem/catconstants/constants.go` — `JoinTokensTableName`
- `pkg/sql/catalog/catprivilege/system.go` — privilege entry
- `pkg/backup/system_schema.go` — backup/restore handling
- `pkg/cli/zip_table_registry.go` — currently excluded from debug zip
- `pkg/sql/opt/testutils/testcat/vtable.go` — test catalog

**Impact:** tidiness only. No behavior change, no fix for a user-visible
problem. Reasonable to defer or to close as won't-do if the migration cost
isn't judged worth it.

Epic: none

Jira issue: CRDB-68086

Start with the TODO in pkg/sql/catalog/systemschema/system.go, then trace bootstrap/metadata.go and existing cluster-version migrations. Review backup/system_schema.go for the older-backup decision, plus the listed privilege, test-catalog, debug-zip, and bootstrap golden files. Done means the table is removed through a gated migration and bootstrap cleanup, while JoinTokensTableID remains reserved and RESTORE behavior is decided.

Written by the indexing model from the issue text.