test(denies): give each xdist worker its own deny principal

[Benjamin-Knight]

Problem

The denies suite failed non-deterministically under pytest -n auto — which is how
make functional runs it. Six of the eight tests, different ones each time. It passed
reliably single-process.

Cause

The suite created and dropped one database-wide user, dbt_deny_reader, from a
class-scoped fixture shared by all eight test classes. A database principal is
database-scoped: unlike project.test_schema, it is not isolated per test. xdist
spreads the classes across worker processes sharing one TestDB, so the first class to
finish dropped the user out from under every class still running, taking its
sys.database_permissions rows with it.

Nothing failed loudly at that point, because apply_denies is deliberately warn-and-skip
on an absent principal. The rebuild succeeded having applied no DENY, and the assertions
saw an empty set:

assert ('SELECT', 'dbt_deny_reader') in set()

Fix

Derive the principal name from PYTEST_XDIST_WORKER (dbt_deny_reader_gw3, or _main off
xdist). Classes on one worker run sequentially, so per-worker names are enough to keep
setup and teardown from overlapping.

The model templates carry a __DENY_PRINCIPAL__ placeholder swapped at import via a small
with_principal() helper. str.format and f-strings are unusable on them — they're Jinja,
and {{ config(...) }} would be eaten as an escaped brace.

Test-only: no adapter behaviour changes.