Add the missing indexes to the CockroachDB schema

[shyundev]

cockroachdb/schema-v6.sql declares 7 indexes where postgres/schema-v6.sql declares 10, though its own header says it matches PostgreSQL schema v6. #3939 added the three to Postgres and H2, fixing #3685; #3352 had branched the CockroachDB script from Postgres v4 a week earlier.

idx_grants_realm_grantee is the one that changes a plan. The grant_records primary key continues with the securable columns after realm_id, so loadAllGrantRecordsOnGrantee, which filters realm_id, grantee_catalog_id and grantee_id, can use only the realm prefix. EXPLAIN ANALYZE on CockroachDB 25.3, 200k grant records in one realm: 200,000 KV rows in 61ms on grant_records_pkey, against 200 rows in 377µs on the new index.

Measured, the other two change no plan: the primary key already yields exact spans for the securable lookup and for the entities tuple-IN query. They are declared so schema v6 means the same objects on every backend, as #5349's v3-to-v4 migration assumes; its cockroachdb/schema.sql still lacks all three.

Only schema-v6.sql is touched; v4 and v5 have shipped. Existing deployments need the one-time DDL in the CHANGELOG upgrade notes. The Cockroach bootstrap, purge and IT suites run this script against a real container in CI.

Checklist

• 🛡️ Don't disclose security issues! (contact security@apache.org)
• 🔗 Clearly explained why the changes are needed, or linked related issues: Related to Performance Critical: create_namespace Latency (>30s) - Schema & Query Optimization Required #3685
• 🧪 Added/updated tests with good coverage, or manually tested (and explained how)
• 💡 Added comments for complex logic
• 🧾 Updated CHANGELOG.md (if needed)
• 📚 Updated documentation in site/content/in-dev/unreleased (if needed)

[shyundev]

@adutra could you re-run the failed job? test-site-guides failed on the Spark tarball download (gzip: stdin: not in gzip format), unrelated to this change.

[vigneshio]

LGTM.. Thanks @shyundev