feat(migrations): predefined role grants

- supabase_etl_admin needs pg_monitor to query system catalog tables
(e.g. pg_replication_slots) - supabase_read_only_user needs pg_monitor
to view queries in pg_stat_statements - grant pg_create_subscription to
postgres with admin option in case users want to create subscriptions
with their own roles

Author: soedirgo

migrations/db/migrations/20251001204436_predefined_role_grants.sql

@@ -0,0 +1,15 @@
+-- migrate:up
+grant pg_monitor to supabase_etl_admin, supabase_read_only_user;
+
+do $$
+declare
+  major_version int;
+begin
+  select current_setting('server_version_num')::int / 10000 into major_version;
+
+  if major_version >= 16 then
+    grant pg_create_subscription to postgres with admin option;
+  end if;
+end $$;
+
+-- migrate:down