ENG-6388 split adhoc permission into sql and sqlread

As Anish pointed out, if you combine this with `InvocationSqlPermissionPolicy` it'll be simpler.