RLS support for ON CONFLICT UPDATE

RLS support for ON CONFLICT UPDATE

This commit establishes that only insert policies are enforced on
post-insert tuples (as before), only update USING/security barrier quals
are enforced (as WCOs, with errors thrown) on existing TARGET.* tuples
(before ON CONFLICT UPDATE), and post-update tuple only has WCO
enforcement (without USING/security barrier qual enforcement).

In general, the implementation treats RLS with INSERT ... ON CONFLICT
UPDATE as close to regular INSERT/UPDATE behavior as possible.  The
consistent enforcement of USING/security barrier qualifications as WCOs
is the only real deviation.

Note to committer to authoritative master branch:  This commit is
intended to be squashed into the main ON CONFLICT UPDATE commit.  It has
only been split out for easier review by subject matter experts.