Fix Table ACL migration logic (#1149)

## Changes
Fixed logic where list of grants are not reset between table iteration.
Also updated tests to catch these issues

### Tests
<!-- How is this tested? Please see the checklist below and also
describe any other relevant tests -->

- [x] manually tested
- [x] added unit tests
- [ ] verified on staging environment (screenshot attached)

Co-authored-by: Serge Smertin <[email protected]>

Author: nkvuong

src/databricks/labs/ucx/hive_metastore/table_migrate.py

@@ -84,13 +84,13 @@ def migrate_tables(self, *, what: What | None = None, acl_strategy: list[AclMigr
         self._init_seen_tables()
         tables_to_migrate = self._tm.get_tables_to_migrate(self._tc)
         tasks = []
-        grants = []
         if acl_strategy is not None:
             grants_to_migrate = self._gc.snapshot()
             migrated_groups = self._group.snapshot()
         else:
             acl_strategy = []
         for table in tables_to_migrate:
+            grants = []
             if what is not None and table.src.what != what:
                 continue
             if AclMigrationWhat.LEGACY_TACL in acl_strategy:

tests/unit/hive_metastore/test_table_migrate.py

@@ -631,8 +631,14 @@ def test_migrate_acls_should_produce_proper_queries(ws, caplog):
     table_migrate.migrate_tables(acl_strategy=[AclMigrationWhat.LEGACY_TACL])
 
     assert "GRANT SELECT ON TABLE ucx_default.db1_dst.managed_dbfs TO `account group`" in backend.queries
+    assert "GRANT MODIFY ON TABLE ucx_default.db1_dst.managed_dbfs TO `account group`" not in backend.queries
+    assert "ALTER TABLE ucx_default.db1_dst.managed_dbfs OWNER TO `account group`" not in backend.queries
     assert "GRANT MODIFY ON TABLE ucx_default.db1_dst.managed_mnt TO `account group`" in backend.queries
+    assert "GRANT SELECT ON TABLE ucx_default.db1_dst.managed_mnt TO `account group`" not in backend.queries
     assert "ALTER TABLE ucx_default.db1_dst.managed_other OWNER TO `account group`" in backend.queries
+    assert "GRANT SELECT ON TABLE ucx_default.db1_dst.managed_other TO `account group`" not in backend.queries
+    assert "GRANT MODIFY ON TABLE ucx_default.db1_dst.managed_other TO `account group`" not in backend.queries
     assert "GRANT SELECT ON VIEW ucx_default.db1_dst.view_dst TO `account group`" in backend.queries
+    assert "GRANT MODIFY ON VIEW ucx_default.db1_dst.view_dst TO `account group`" not in backend.queries
 
     assert "Cannot identify UC grant" in caplog.text