RLS: Initial demo of rewriter based row security

lacks recursion detection (but that looks easy now), plan invalidation so far

Still needs proper COPY (not just ERROR)