Adds a hidden vtctld command to update shard tablet controls on the cluster:

pscale branch vtctld set-shard-tablet-control <database> <branch> \
  --keyspace <keyspace> --shard <shard> --tablet-type rdonly \
  --denied-tables <table>

Requires at least one of --remove, --denied-tables, or --disable-query-service.

Depends on planetscale/planetscale-go#315.

Manual testing

Tested end-to-end against a dev Vitess branch (org with direct_vtctld_access enabled) with the full stack deployed.

1. Baseline get-shard on unsharded keyspace test-vtctld/- returned empty tablet_controls.
2. Added denied table:

   pscale branch vtctld set-shard-tablet-control <database> <branch> \
     --keyspace test-vtctld --shard - --tablet-type rdonly --denied-tables customers
   

   returned {}. Re-ran get-shard and confirmed:

   {
     "tablet_controls": [
       {
         "tablet_type": 3,
         "cells": [],
         "denied_tables": ["customers"],
         "frozen": false
       }
     ]
   }

3. Removed denied table:

   pscale branch vtctld set-shard-tablet-control <database> <branch> \
     --keyspace test-vtctld --shard - --tablet-type rdonly \
     --remove --denied-tables customers
   

   get-shard then showed empty tablet_controls again.
4. CLI validation: omitting all mutation flags returns must specify at least one of --remove, --denied-tables, or --disable-query-service.
5. Repeated add/remove on sharded keyspace sharded-2/-80 with --denied-tables orders — same behavior.