cdc: protect all required tables under pts

[wenyihu6]

Describe the problem

For standard changefeeds, CDC only protects the DescriptorTableID table when creating the PTS record. https://github.com/cockroachdb/cockroach/blob/8c7a79c0f1b66578a03d825bf63a89cda66d84bc/pkg/ccl/changefeedccl/protected_timestamps.go#L54 However, this is insufficient for CDC, since other system tables are required to read descriptors. For CDC queries there are additional requirements, as the query planner requires access to additional tables for checks. We should at least identify which tables are needed to resume changefeeds and ensure they are properly protected. A more robust, less error-prone solution would be more ideal though.

More details in https://github.com/cockroachlabs/support/issues/3008.

Tables that have been identified as required so far:

• [x] system.zones
• [x] system.comments
• [x] system.role_members
• [x] users (https://github.com/cockroachdb/cockroach/pull/133568)
• [ ] other tables, these should be identified and added. see https://github.com/cockroachdb/cockroach/issues/133566
• [ ] We also need to be able to migrate long-running jobs to use new tables.. see https://github.com/cockroachdb/cockroach/issues/133578

Jira issue: CRDB-41217

Epic CRDB-41784

[blathers-crl[bot]]

Hi @wenyihu6, please add branch-* labels to identify which branch(es) this C-bug affects.

_{:owl: Hoot! I am a Blathers, a bot for CockroachDB. My owner is dev-inf.}

[blathers-crl[bot]]

cc @cockroachdb/cdc

[rharding6373]

I've seen some evidence in cloud that the system.role_members may be a dependency for enterprise changefeeds without cdc queries as well.