feat: support MCP Server resource (CREATE MCP SERVER) and MCP server grants

[GClunies]

What & Why

Snowflake now supports managed MCP servers (CREATE MCP SERVER ... FROM SPECIFICATION $$...$$) that expose governed tools (e.g. SYSTEM_EXECUTE_SQL) to external MCP clients like Claude. Snowcap has no ResourceType.MCP_SERVER and no resource class, so MCP servers must be managed with hand-run SQL outside the declarative workflow.

This is especially painful because CREATE OR REPLACE MCP SERVER drops all existing USAGE grants — a declarative resource that diffs the specification and updates in place (instead of replacing) would remove a real footgun.

Real-world usage we currently manage via one-off SQL scripts:

CREATE OR REPLACE MCP SERVER my_db.mcp.claude_mcp_server
  FROM SPECIFICATION $$
    tools:
      - name: "query_data"
        type: "SYSTEM_EXECUTE_SQL"
        title: "SQL Execution Tool"
        description: "Execute read-only SQL queries."
        config:
          read_only: true
          query_timeout: 300
  $$;

GRANT USAGE ON MCP SERVER my_db.mcp.claude_mcp_server TO ROLE analyst;

Acceptance Criteria

• New schema-scoped mcp_server resource (mcp_servers: YAML key) with a specification property (the tool spec YAML/text)
• Plan/apply diffs the specification and updates in place where possible, so grants are not silently dropped by OR REPLACE
• GRANT USAGE ON MCP SERVER <name> is expressible via grants: (on_mcp_server:) and round-trips through fetch/plan
• Docs page under docs/resources/

Resources

• Snowflake docs: CREATE MCP SERVER / Snowflake-managed MCP servers
• Snowcap: no MCP entries in snowcap/enums.py or snowcap/resources/ today