Postgresql: merge fails to enforce update or select row security policies

PostgreSQL's MERGE command doesn't properly check security rules when updating rows, potentially allowing users to save data that should be blocked by security policies.

The MERGE command in PostgreSQL fails to enforce row security policies (RLS) for UPDATE and SELECT operations on new rows, allowing an attacker with MERGE privileges to bypass row-level security restrictions and insert rows that would normally be rejected by UPDATE or SELECT policies.