StorageSystemAsynchronousInserts::fillData iterated over all async
insert queue entries with no user filtering, allowing any user with
SELECT ON system.asynchronous_inserts to see pending inserts belonging
to other users (query, database, table, entries.query_id, etc.).

Fix: filter queue entries in fillData so that only the current user's
own entries are returned, unless the user has the SHOW_USERS privilege
(which represents elevated visibility over user-related data).

The InsertQuery struct already carries a user_id field populated
from query_context->getUserID() at push time; this fix simply
consults it during read.

just like system.query_cache (which has an explicit design comment justifying cross-user visibility)

Changelog category (leave one):

• Critical Bug Fix (crash, data loss, RBAC)

Changelog entry (a user-readable short description of the changes that goes into CHANGELOG.md):

...

Documentation entry for user-facing changes

• Documentation is written (mandatory for new features)