fix: with_grant_option diff drift

[sfc-gh-jcieslak]

Fixes: #2459

The issue was related to the fact that the Read operation is only concerned about privileges (with_grant_option is also taken into consideration, but it's never set). Given this configuration:

resource "snowflake_grant_privileges_to_account_role" "test" {
  account_role_name = "TEST_ROLE"
  privileges = ["TRUNCATE"]
  on_schema_object {
    object_type = "TABLE"
    object_name = "TEST_DATABASE.TEST_SCHEMA.TEST_TABLE"
  }
  with_grant_option = true
}

after apply we run the following commands by hand

revoke truncate on table test_table from role test_role;
grant truncate on table test_table to role test_role; -- notice we don't add "with grant option" which our resource should detect

Now, when we run plan or apply our resource is seeing a drift (the "TRUNCATE" privilege is not present, because with_grant_option is not matching) and tries to run the Update operation (unsuccessfully; 1. because of the "sdk.GrantPrivOptions" not set 2. because of the incorrect logic). When there're already existing grants there are two ways to update with_grant_option which depends on what is set in Snowflake. It's better to show it with SQLs, so:

-- imagine this is ran by Snowflake Terraform Plugin (with_grant_option is set to true in the config)
grant truncate on table test_table to role test_role with grant option;

-- this is ran by hand in the worksheet
revoke truncate on table test_table from role test_role;
grant truncate on table test_table to role test_role; 

-- now update tries to run the following
grant truncate on table test_table to role test_role with grant option; -- this will successfully update with_grant_option to 'true'

-- imagine this is ran by Snowflake Terraform Plugin (with_grant_option is set to false in the config)
grant truncate on table test_table to role test_role;

-- this is ran by hand in the worksheet
revoke truncate on table test_table from role test_role;
grant truncate on table test_table to role test_role with grant option; 

-- now update tries to run the following
grant truncate on table test_table to role test_role; -- this won't update the with_grant_option to false because Snowflake is not updating the value when the option is already set to true (you have to revoke it first)

The fix I opted to is to:

• when with_grant_option is set to true in the config
  • proceed as it was (but now set option struct correctly with with_grant_option set to true)
• when with_grant_option is set to false in the config
  • firstly revoke privileges we would like to add (just in case this issue happens; it won't fail even if the grant does not exist)
  • then proceed as it was (grant privileges we would like to add)

todo other grant privileges to database role

Test Plan

• Acceptance tests that prove the issue has been fixed for every privilege-granting resource

[github-actions]

Integration tests success for ec831cd559ecc7343ca6fccb261eda704e2d6e34

[github-actions]

Integration tests failure for ea19b61e5dc85815508093aec7b88c83332891e9

[github-actions]

Integration tests failure for 4a80c90aa42f732b66a112dd6424f455f0dfe563

[github-actions]

Integration tests failure for 363136a2ad2ce7155e70b035b33ef5cba2116095

[github-actions]

Integration tests failure for e26a4f9ff207a02064b4b538c9c6e5555f4eaf51

[github-actions]

Integration tests failure for 7dff96c2a42fb9e8aa4426381c69c01fee4fe819

[github-actions]

Integration tests failure for 3fc15c3176df920989b3f6f876aff899f92be2c8