Add dynamic privilege for ALTER INSTANCE RELOAD TLS (avoid requiring SUPER)

## Feature Request

**Is your feature request related to a problem? Please describe:**

`ALTER INSTANCE RELOAD TLS` currently requires the `SUPER` privilege in TiDB v8.5.0. Granting only `RELOAD` returns:

```
ERROR 1227 (42000): Access denied; you need (at least one of) the SUPER privilege(s) for this operation
```

This forces operators to grant `SUPER ON *.*` to dedicated service accounts whose sole purpose is TLS certificate hot-reload. `SUPER` is root-equivalent (kill sessions, set globals, bypass read-only, etc.) and cannot be scoped — it violates the principle of least privilege for what is fundamentally a single administrative operation.

In MySQL 8.0, the `RELOAD` static privilege is sufficient for `ALTER INSTANCE RELOAD TLS`.

**Describe the feature you'd like:**

Either:

1. **Make `RELOAD` sufficient** for `ALTER INSTANCE RELOAD TLS` — aligned with MySQL 8.0 behavior.
2. **Introduce a dynamic privilege** (e.g., `RELOAD_ADMIN`) following the existing pattern where `SYSTEM_VARIABLES_ADMIN` replaces `SUPER` for `SET GLOBAL` and `BACKUP_ADMIN` replaces `SUPER` for backup operations.

The privilege check in the executor should accept `RELOAD` OR `RELOAD_ADMIN` OR `SUPER` (backwards-compatible).

**Describe alternatives you've considered:**

- Granting `SUPER` — works but overly permissive for a single-purpose cert-rotation service account.
- Granting `CONNECTION_ADMIN` — tested, does not satisfy the check.
- Granting `SYSTEM_VARIABLES_ADMIN` — not semantically related, does not work.
- Pod restart instead of `ALTER INSTANCE RELOAD TLS` — kills active queries, not zero-downtime.

**Teachability, Documentation, Adoption, Migration Strategy:**

**Use case**: Automated TLS certificate rotation on Kubernetes with short-lived certs (24h TTL via Vault PKI). A Kubernetes CronJob runs hourly and executes `ALTER INSTANCE RELOAD TLS` on each TiDB pod to pick up rotated certificates without disconnecting sessions. The dedicated `tls_reloader` MySQL user authenticates via X.509 cert (`REQUIRE X509`) and should need only the minimal privilege for this operation.

**Suggested implementation** (in `pkg/executor/simple.go` or equivalent):

```go
// Before (current):
if !checker.RequestVerification(activeRoles, "", "", "", mysql.SuperPriv) {
return ...
}

// After (proposed):
if !checker.RequestVerification(activeRoles, "", "", "", mysql.SuperPriv) &&
!checker.RequestVerification(activeRoles, "", "", "", mysql.ReloadPriv) &&
!checker.RequestDynamicVerification(activeRoles, "RELOAD_ADMIN", false) {
return ...
}
```

**Migration**: Fully backwards-compatible. Users with `SUPER` continue to work. Users can now also use the narrower `RELOAD` or `RELOAD_ADMIN`.

**Environment**: TiDB v8.5.0, TiDB Operator v2.0.0, Kubernetes, Vault + VSO for cert lifecycle.
```

Start in pkg/executor/simple.go or the equivalent executor entry point for ALTER INSTANCE RELOAD TLS, then compare the existing SYSTEM_VARIABLES_ADMIN and BACKUP_ADMIN dynamic-privilege checks. Resolve whether RELOAD, RELOAD_ADMIN, or both should be accepted, preserve SUPER compatibility, and run the relevant executor privilege tests.

Written by the indexing model from the issue text.