Enforce TiDB X resource group SQL restrictions in SEM v2

## Enhancement

### Problem

TiDB X does not support user-managed resource groups, but enforcement currently depends on an externally delivered SEM v2 configuration. If that configuration is missing or incomplete, users can execute resource group statements that the product does not support.

### Proposed behavior

For NextGen (TiDB X) builds, make the following statements a built-in, non-removable SEM v2 baseline:

- `CREATE RESOURCE GROUP`
- `ALTER RESOURCE GROUP`
- `DROP RESOURCE GROUP`
- `SET RESOURCE GROUP`
- `SHOW CREATE RESOURCE GROUP`
- `CALIBRATE RESOURCE`

External `restricted_sql` rules should remain additive. Existing `RESTRICTED_SQL_ADMIN` behavior should continue to provide the privileged bypass. Classic builds must remain unchanged.

Only the SQL restrictions belong in the built-in baseline. Tier-specific variable restrictions, including whether `tidb_enable_resource_control` is read-only, should remain in external SEM configuration.

### Acceptance criteria

- Ordinary users cannot execute any of the six statements in a NextGen build, even without an external SEM configuration.
- Accounts with `RESTRICTED_SQL_ADMIN` can execute them.
- Classic builds preserve the current behavior.
- External SEM v2 SQL restrictions are unioned with the built-in baseline.

Start by locating SEM v2 enforcement and the NextGen-versus-Classic build handling, then inspect how restricted_sql rules and RESTRICTED_SQL_ADMIN bypasses are tested. Verify the six resource-group statements are blocked by the built-in baseline, remain executable for privileged accounts, and are unioned with external restrictions without changing Classic behavior.

Written by the indexing model from the issue text.