sql: cap the tenant IDs that can be allocated via create_tenant

This patch introduces a limit (MaxUint32) to the fixed IDs that can be
selected by `crdb_internal.create_tenant`. This ensures that there are
always IDs remaining available for CREATE TENANT after the maximum
value has been selected via `create_tenant`.

Release note: None

pkg/sql/logictest/testdata/logic_test/tenant_builtins

@@ -380,3 +380,8 @@ query I
 SELECT crdb_internal.create_tenant('{"name":"tenant-number-ten", "if_not_exists": true}'::JSONB)
 ----
 NULL
+
+subtest avoid_too_large_ids
+
+query error tenant ID 10000000000 out of range
+SELECT crdb_internal.create_tenant(10000000000)

pkg/sql/tenant_creation.go

@@ -14,6 +14,7 @@ import (
 	"context"
 	gojson "encoding/json"
 	"fmt"
+	"math"
 	"strings"
 	"time"
 
@@ -62,6 +63,14 @@ func (p *planner) CreateTenant(
 		}
 	}
 
+	if ctcfg.ID != nil && *ctcfg.ID > math.MaxUint32 {
+		// Tenant creation via this interface (which includes
+		// crdb_internal.create_tenant) should be prevented from gobbling
+		// up the entire tenant ID space by asking for too large values.
+		// Otherwise, CREATE TENANT will not be possible any more.
+		return tid, pgerror.Newf(pgcode.ProgramLimitExceeded, "tenant ID %d out of range", *ctcfg.ID)
+	}
+
 	configTemplate := mtinfopb.TenantInfoWithUsage{}
 
 	return p.createTenantInternal(ctx, ctcfg, &configTemplate)