Provide server-side field validation / protected owner field to prevent client-side spoofing of userId on row creation

### 🔖 Enhancement description **Problem:** Appwrite currently allows clients to set arbitrary row fields when calling `tables.createRow(...)` (or similar document creation APIs). That includes an owner field such as `userId`. Because creation can be called from the client SDK, a malicious client can forge the `userId` field and create a row in *another* user's name. Appwrite permissions and row security control read/update/delete access, but they do not provide a declarative server-side mechanism to enforce "this field must equal the authenticated user's id" or to *protect* specific fields from being set by the client. **Enhancement:** Add a server-side feature to declare protected/validated fields or validation rules on table/collection schemas that are enforced by the Appwrite server at create/update time. This could take the form of: * Built-in validation rule(s) that compare a field to the authenticated user, e.g. `data.userId == auth.uid` or a shorthand `mustEqualAuth('userId')`. * A field property (column setting) like `protected: true` or `immutableOwner: true` that prevents the client from setting that field; the server automatically sets it from the authenticated user context when creating a row. * Or a general validation expression language for create/update that can reference `auth` and `data` (e.g. `allowCreate: data.owner == auth.uid`). This feature ensures ownership fields are authoritative and cannot be spoofed from an untrusted client. ### 🎤 Pitch **Why implement this?** 1. **Security & correctness:** Prevents a common attack vector where a malicious client forges ownership fields (e.g. `userId`) and creates or claims resources that belong to other users. Permissions alone do not fully solve this because clients can still create data with fake `userId` values. 2. **Developer ergonomics:** Developers currently must funnel all create/update requests through a trusted environment (Appwrite Functions or a custom backend) to enforce ownership. Built-in …