feat(database): support shared databases (FROM SHARE) and IMPORTED PRIVILEGES grants

[GClunies]

What & Why

Databases created from inbound shares — direct shares and Snowflake Marketplace listings — cannot be managed by snowcap:

• snowcap/resources/shared_database.py exists but is entirely commented out (no SharedDatabase resource is registered).
• IMPORTED PRIVILEGES is commented out in snowcap/privs.py (# IMPORTED_PRIVILEGES = "IMPORTED PRIVILEGES" # only granted on shared database), so even the access-role pattern around an existing shared database can't be expressed.

We manage several of these (Gong, HubSpot, Foursquare OSS Places from Marketplace) via manual SQL, with comments like "We can't use Snowcap to create/manage this database because it's a shared database":

CREATE DATABASE gong FROM SHARE provider_account.share_name;

CREATE ROLE gong_r;
GRANT IMPORTED PRIVILEGES ON DATABASE gong TO ROLE gong_r;
GRANT ROLE gong_r TO ROLE data_engineer;

Even just supporting the grant side (IMPORTED PRIVILEGES) would let the RBAC around shared databases live in YAML.

Acceptance Criteria

• GRANT IMPORTED PRIVILEGES ON DATABASE <db> TO ROLE <role> is expressible in grants: and round-trips through fetch/plan
• A shared_database resource (or from_share: on databases) supports CREATE DATABASE <name> FROM SHARE <provider>.<share>
• Plan respects the limited mutability of shared databases (no schemas/params management; comment/ownership only)
• Docs page under docs/resources/

Resources

• Snowflake docs: CREATE DATABASE ... FROM SHARE, GRANT IMPORTED PRIVILEGES
• Snowcap: snowcap/resources/shared_database.py (commented out), snowcap/privs.py (IMPORTED_PRIVILEGES commented out)