The entity whose denial the reference reaches; null when the text could not be read.
DeniedField: the reference as the database reads it (a quoted identifier's bare name; on
PostgreSQL an unquoted name in lower case). WholeRow: the construct, such as FOR JSON.
Unresolvable: why the text could not be read. UnknownRelation: the relation the catalog
does not know.
One reason FieldSecuritySQLGate.FindViolation refuses a piece of SQL.