[iceberg] Refuse types the mirror cannot publish before the commit or the replace

[plusplusjiajia]

Purpose

Blob and vector columns have no Iceberg type, and variant needs format version 3, but the mirror only finds out inside IcebergDataField while converting a schema it has already been told to publish, so the snapshot is durable by then and every later commit keeps failing the same way; this validates the same rule where the timestamp and time rules already run, on the current schema at DDL time and on the whole schema history when the mirror is enabled on an existing table, so the refusal lands before the commit instead of after it, and the conversion-layer checks stay as backstops for tables created before this guard.
replaceTable drops or truncates the table it replaces before the new schema reaches the validation in SchemaManager, and neither is undone when that validation refuses the schema, so a replacement carrying one of these types took the old data with it; this judges the replacement schema, directives expanded, before either destructive step, which also covers every other rule validateTableSchema enforces