The permission check of `DROP STATS` command is missing

## Bug Report

The permission check of `DROP STATS` command is missing. A user without any privileges can also execute the command on unauthorized tables.

It can be reproduced on docker image `pingcap/tidb:nightly`.

### 1. Minimal reproduce step (Required)

1. Create an empty user with root:
```sql
-- login as user 'root'
-- create a table for test
CREATE DATABASE test;
CREATE TABLE test.tbl (x INT);

-- create an empty user
CREATE USER foo;
SHOW GRANTS FOR foo;
/*
+---------------------------------+
| Grants for foo@% |
+---------------------------------+
| GRANT USAGE ON *.* TO 'foo'@'%' |
+---------------------------------+
*/
```

2. Log in as the user foo and execute (**Note that foo does not have any privileges**):
```sql
-- login as user 'foo'
DROP STATS test.tbl;
-- Query OK, 0 rows affected (0.02 sec)
```

### 2. What did you expect to see? (Required)

Since the user 'foo' does not have any privilege, he should not be able to execute the `DROP STATS` command on unauthorized tables.

### 3. What did you see instead (Required)

The command succeed unexpectedly.

### 4. What is your TiDB version? (Required)

```
+------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| tidb_version() |
+------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| Release Version: v8.5.2-20250707-57b0825
Edition: Community
Git Commit Hash: 57b0825102d3dce7679856df8f39e1c8641285d7
Git Branch: heads/refs/tags/v8.5.2-20250707-57b0825
UTC Build Time: 2025-07-07 09:12:09
GoVersion: go1.23.6
Race Enabled: false
Check Table Before Drop: false
Store: unistore |
+------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
```

Start by reproducing the unauthorized DROP STATS execution using the SQL steps in the issue, then trace the command's permission-check entry point and existing authorization tests. Done means users without privileges are rejected on unauthorized tables and a regression test covers this case.

Written by the indexing model from the issue text.