feat: enforce DDS token access through common grants

sql/adb/35_dds_token_data_grant_cleanup.sql

@@ -0,0 +1,24 @@
+-- Remove only the token-driven DDS demonstration objects.
+-- Run as ADMIN after confirming no application still uses dds_demo_token.
+WHENEVER SQLERROR EXIT SQL.SQLCODE
+SET ECHO ON
+SET FEEDBACK ON
+SET DEFINE OFF
+
+DROP DATA GRANT IF EXISTS admin.dds_demo_token_vector_grant;
+DROP FUNCTION admin.cb_dds_vector_tag_allowed;
+DROP DATA ROLE IF EXISTS cb_dds_token_role;
+
+BEGIN
+  EXECUTE IMMEDIATE 'DROP ROLE cb_dds_token_connect_role';
+EXCEPTION
+  WHEN OTHERS THEN
+    IF SQLCODE != -1919 THEN
+      RAISE;
+    END IF;
+END;
+/
+
+DROP END USER IF EXISTS "dds_demo_token";
+PROMPT DDS token DATA GRANT objects removed.
+EXIT;