Support server-side column masking feature

## Summary

Tracking issue for **server-side column-level masking** in TiDB.

Goal: support policy-based masking at query-result time, with optional operation restrictions and policy lifecycle management.

## Scope

- New masking policy DDL / SHOW syntax
- Expression-based masking (`CASE WHEN ...`, `current_user()`, `current_role()`)
- `RESTRICT ON` operation controls
- Supported masking functions and type coverage
- System table metadata (`masking_type`, policy state, binding metadata)
- Privilege model for policy management

## Current Status (as of February 27, 2026)

- Parser phase is in progress and being iterated in dedicated PR(s)
- Parser PR: https://github.com/pingcap/tidb/pull/66031
- Design doc
- Docs PR: https://github.com/pingcap/tidb/pull/66563
- User Document
- Docs PR: https://github.com/pingcap/docs/pull/22613
- Test Resport ([internal](https://pingcap.feishu.cn/wiki/Rp6hwRW01i5eZxkvSTmcwPnJnFh?from=from_copylink))

v8.5 [release branch](https://github.com/pingcap/tidb/tree/release-8.5-20260312-v8.5.5) for customer

## Planned PR Breakdown

- `phase1-parser`: syntax / AST / parser tests
- `phaseX-executor|planner|privilege|infoschema`: incremental runtime implementation PRs
- docs PRs for design/spec alignment when needed
- Add system table mysq.tidb_masking_policy
- https://github.com/pingcap/tidb/pull/66033
- infoschema: add masking policy integration
- https://github.com/pingcap/tidb/pull/66034/
- ddl related statements implementation
- https://github.com/pingcap/tidb/pull/66035
- column masking related builtins functions `MASK_FULL` `MASK_PARTIAL` `MASK_DATE` `MASK_NULL`
- https://github.com/pingcap/tidb/pull/68321
- `SHOW MASKING POLICITIES FOR table` statement
- https://github.com/pingcap/tidb/pull/66036
- Make masking policy take effect (planner, executor part)
- https://github.com/pingcap/tidb/pull/66037

## Issue found

- [ ] #67052
- [ ] batch point-get code path is not covered by masking policy

## Notes

- This feature is TiDB-specific (not full MySQL parity).
- Current baseline follows the latest spec revision (no backward-compat layer for pre-merge drafts).