Also add lower credentials

Make sure a user with credential c/A always also has credential d/A for
all sensitivities d < c except 0.

Also includes a fix in AlterTableAddConstraint for adding constraints to
shadowed tables.