Allow specifying REVOKE after GRANT in the same statement

[joelynch]

This allows an atomic partial revoke WITH REPLACE OPTION. So the full grants / revokes can be done in one statement, without race conditions or worries about a partial revoke failing.

Changelog category (leave one):

• New Feature
• Experimental Feature
• Improvement
• Performance Improvement
• Backward Incompatible Change
• Build/Testing/Packaging Improvement
• Documentation (changelog entry is not required)
• Critical Bug Fix (crash, data loss, RBAC) or LOGICAL_ERROR
• Bug Fix (user-visible misbehavior in an official stable release)
• CI Fix or Improvement (changelog entry is not required)
• Not for changelog (changelog entry is not required)

Changelog entry (a user-readable short description of the changes that goes to CHANGELOG.md):

...

Documentation entry for user-facing changes

• Documentation is written (mandatory for new features)