sql: require serializable isolation when allow_unsafe_internals is enabled

**Is your feature request related to a problem? Please describe.**
An operator can enable `allow_unsafe_internals` in a session whose default transaction isolation is READ COMMITTED or REPEATABLE READ. Direct operations on system tables should preserve the SERIALIZABLE isolation assumptions of those interfaces.

**Describe the solution you'd like**
Require SERIALIZABLE isolation for transactions with `allow_unsafe_internals = true`. Upgrade requests for weaker isolation while the setting is enabled, including transactions using a role or session default. Handle changes to the setting during a transaction so that enabling unsafe internals cannot allow work performed at weaker isolation to commit. Cover explicit transactions, implicit transactions, and local/session setting changes with regression tests.

**Describe alternatives you've considered**
Require operators to explicitly select SERIALIZABLE for every maintenance transaction. Automatic enforcement avoids relying on an operator noticing an inherited weaker isolation default.

**Additional context**
[Related discussion](https://cockroachlabs.enterprise.slack.com/archives/C063CP41TG9/p1788274228146799).

Jira issue: CRDB-68460

No files or tests are named. Start by locating the handling for allow_unsafe_internals and transaction isolation, then trace explicit, implicit, role-default, and session-default transactions. Done means weaker isolation is upgraded or rejected while unsafe internals are enabled, setting changes are safe, and regression tests cover the listed transaction and setting cases.

Written by the indexing model from the issue text.