PostgreSQL Grant accepts mutually exclusive fields without validation

### What happened?

PostgreSQL Grant resources accept both `memberOf` and `database` fields (including their ref/selector variants) simultaneously. These represent fundamentally different grant types (ROLE_MEMBER vs database-level privileges) and cannot coexist, but the API schema does not prevent it.

The error is only surfaced at runtime by the reconciler:

```
cannot set privileges or database in the same grant as memberOf
```

### How can we reproduce it?

- grant.postgresql.sql.m.crossplane.io (namespaced)
- grant.postgresql.sql.crossplane.io (cluster)

with both a `databaseSelector` and `memberOf` filled in.

### What environment did it happen in?
Crossplane version: 2.3.3
Provider v0.15

Start at the API schema for the namespaced and cluster PostgreSQL Grant resources, then trace the reconciler path that currently reports this runtime error. Reproduce the case with both databaseSelector and memberOf set. Done means the schema rejects mutually exclusive memberOf and database fields, including their reference and selector variants, before reconciliation.

Written by the indexing model from the issue text.