protectedts: MakeSchemaObjectsTarget should protect the schema object's metadata

[stevendanna]

Describe the problem

Users of the protected timestamp system (Changefeeds, LDR, BACKUP/RESTORE, etc) often want to assume that if they have a protected timestamp on a table, then they will be able to do things such as issue a historical SQL query, get the correct table descriptor to parse datums on that historical data, and so forth.

However, that currently is not the case. A protected timestamp on a table does not protect that table's namespace or descriptor table rows. While callers could be updated to additionally protect those two tables, those callsites then need to always understand all of the tables that should be protected to plan an arbitrary query against a given table.

It would be nice if we had an API for creating a protected timestamp that protected both the table and all relevant metadata for that table.

Jira issue: CRDB-40397

[stevendanna]

This is written more as an "enhancement". I labelled it "bug" because I am almost certain that we have at least 1 CDC bug related to the existing API.

[rafiss]

I believe this is a similar request to #120391. For now, we likely won't prioritize it unless we hear of a bug that needs this to be addressed in order to fix the bug.

[rafiss]

It seems that when this was being implemented (in #74248), that the decision was made to have the user of the PTS decide if they wanted to protect the system.descriptors table as well. Our team wasn't involved in the design of this, so I don't know for sure, but I'm basing this off of this block of code, which shows changefeeds opting-in to protecting system.descriptors rather than assuming that it will get protected automatically:

cockroach/pkg/ccl/changefeedccl/protected_timestamps.go

Lines 45 to 56 in 8c7a79c

	func makeTargetToProtect(targets changefeedbase.Targets) *ptpb.Target {
	// NB: We add 1 because we're also going to protect system.descriptors.
	// We protect system.descriptors because a changefeed needs all of the history
	// of table descriptors to version data.
	tablesToProtect := make(descpb.IDs, 0, targets.NumUniqueTables()+1)
	_ = targets.EachTableID(func(id descpb.ID) error {
	tablesToProtect = append(tablesToProtect, id)
	return nil
	})
	tablesToProtect = append(tablesToProtect, keys.DescriptorTableID)
	return ptpb.MakeSchemaObjectsTarget(tablesToProtect)
	}