release-22.2: opt: fix ordering-related optimizer panics

[DrewKimball]

Backport 1/1 commits from #100776.

/cc @cockroachdb/release

---

It is possible for some functional-dependency information to be visible to a child operator but invisible to its parent. This could previously cause panics when a child provided an ordering that could be proven to satisfy the required ordering with the child FDs, but not with the parent's FDs.

This patch adds a step to the logic that builds provided orderings that ensures a provided ordering can be proven to respect the required ordering without needing additional FD information. This ensures that a parent never needs to know its child's FDs in order to prove that the provided ordering is correct. The extra step is a no-op in the common case when the provided ordering can already be proven to respect the required ordering.

Informs #85393
Informs #87806
Fixes #96288

Release note (bug fix): Fixed a rare internal error in the optimizer that has existed since before version 22.1, which could occur while enforcing orderings between SQL operators.

Release justification: Fix for internal error and possible incorrect results in the optimizer.

[blathers-crl]

Thanks for opening a backport.

Please check the backport criteria before merging:

• Patches should only be created for serious issues or test-only changes.
• Patches should not break backwards-compatibility.
• Patches should change as little code as possible.
• Patches should not change on-disk formats or node communication protocols.
• Patches should not add new functionality.
• Patches must not add, edit, or otherwise modify cluster versions; or add version gates.

If some of the basic criteria cannot be satisfied, ensure that the exceptional criteria are satisfied within.

• There is a high priority need for the functionality that cannot wait until the next release and is difficult to address in another way.
• The new functionality is additive-only and only runs for clusters which have specifically “opted in” to it (e.g. by a cluster setting).
• New code is protected by a conditional check that is trivial to verify and ensures that it only runs for opt-in clusters.
• The PM and TL on the team that owns the changed code have signed off that the change obeys the above rules.

Add a brief release justification to the body of your PR to justify this backport.

Some other things to consider:

• What did we do to ensure that a user that doesn’t know & care about this backport, has no idea that it happened?
• Will this work in a cluster of mixed patch versions? Did we test that?
• If a user upgrades a patch version, uses this feature, and then downgrades, what happens?

[cockroach-teamcity]

This change is 

[yuzefovich]

LGTM, but I'll defer to Marcus.

Reviewed 3 of 3 files at r1, all commit messages.
Reviewable status: complete! 0 of 0 LGTMs obtained (waiting on @mgartner)

[rafiss]

The new policy wants us to answer these questions in the backport PR comments:

Are all of the changes protected via a flag or option, new syntax, an environment variable or default-disabled cluster setting?

What are the risks to backporting this change? Can the risks of backporting be mitigated? What are the risks to not backporting?

Does this change really need to be backported? Or can it reasonably wait until the next major release to be addressed?

[DrewKimball]

Are all of the changes protected via a flag or option, new syntax, an environment variable or default-disabled cluster setting?

There's no setting for this fix. I think it'd be easy to add, so I'll do so now.

[mgartner]

If we backport behind a setting, I think it should be enabled by default because this fixes a correctness bug, as described in https://github.com/cockroachlabs/support/issues/2680. The setting would just be an escape hatch if we discover something worse than the incorrect results that this fixes.

[yuzefovich]

Super-seded by #113175.