ENG-6388 split adhoc permission into sql and sqlread

Ah, DDL won't survive this check, though.  Or, they'll survive it incorrectly (A user with SQLREAD permission will be allowed to invoke DDL, potentially)