feat: Add CREATE FUNCTION and DROP FUNCTION privileges support

[and-longhi]

Summary

This PR adds support for CREATE FUNCTION and DROP FUNCTION privileges in the ClickHouse Terraform provider, validating that these global privileges can only be used with database = "*"

Changes

• Added CREATE FUNCTION and DROP FUNCTION to AllowedGlobalPrivileges in validators.go
• These privileges are configured as global-level privileges that require database = "*"
• Created comprehensive test suite in resource_role_function_test.go with:
  • TestAccResourceRole_FunctionPrivileges - Tests creating roles with CREATE FUNCTION and DROP FUNCTION privileges
  • TestAccResourceRole_ValidationCreateFunction - Validates CREATE FUNCTION is rejected when database != "*"
  • TestAccResourceRole_ValidationDropFunction - Validates DROP FUNCTION is rejected when database != "*"

Test Results

All tests pass successfully:

=== RUN   TestAccResourceRole_FunctionPrivileges
--- PASS: TestAccResourceRole_FunctionPrivileges (0.42s)
=== RUN   TestAccResourceRole_ValidationCreateFunction
--- PASS: TestAccResourceRole_ValidationCreateFunction (0.26s)
=== RUN   TestAccResourceRole_ValidationDropFunction
--- PASS: TestAccResourceRole_ValidationDropFunction (0.27s)
PASS

[and-longhi]

Additional Fix

Fixed a pre-existing test failure in TestAccResourceRole by excluding REMOTE and S3 privileges from the global privileges test.

Why: ClickHouse expands REMOTE and S3 privileges into READ and WRITE privileges internally, causing privilege count mismatches in the test assertions. These privileges are still validated individually in separate test cases.

Implementation: Added getTestableGlobalPrivileges() helper function that filters out REMOTE and S3 from AllowedGlobalPrivileges when running the comprehensive global privileges test.