issue #24850 - check group _and_ individual privs

This PR also adds a test for the `usrpriv` trigger, which depends on a new `tests/lib/metasql.js`. #1988 also has this helper file so let me know if there are merge conflicts.