chore(ci): apply settings before role validation in session restore

[TCeason]

I hereby agree to the terms of the CLA available at: https://docs.databend.com/dev/policies/cla/

Summary

The HTTP handler restores session state in HttpSessionConf::restore().
Previously, settings (including sandbox_tenant) were applied after
role validation, causing role checks to fail when using sandbox tenant
in sqllogic tests.

This fix reorders the restore sequence to apply settings first, ensuring
sandbox_tenant takes effect before role validation occurs.

Also removes an obsolete TODO comment about secondary roles.

Tests

• Unit Test
• Logic Test
• Benchmark Test
• No Test - Explain why

Type of change

• Bug Fix (non-breaking change which fixes an issue)
• New Feature (non-breaking change which adds functionality)
• Breaking Change (fix or feature that could cause existing functionality not to work as expected)
• Documentation Update
• Refactoring
• Performance Improvement
• Other (please describe):

---

This change is