**Describe what's wrong**

UDF functions are global objects. Creating or dropping them requires global level privilege.

- https://clickhouse.com/docs/en/sql-reference/statements/create/function/
- https://github.com/ClickHouse/ClickHouse/blob/14811a357e2136ff2940d791f2dbe59c65e87601/tests/integration/test_access_for_functions/test.py#L22

But "system.privileges" table reports DATABASE level for these privileges.

```
SELECT
    privilege,
    level
FROM system.privileges
WHERE CAST(privilege, 'text') LIKE '%FUNCTION%'

┌─privilege──────────────┬─level────┐
│ CREATE FUNCTION        │ DATABASE │
│ DROP FUNCTION          │ DATABASE │
│ SYSTEM RELOAD FUNCTION │ GLOBAL   │
└────────────────────────┴──────────┘
```

**Does it reproduce on recent release?**

Actual for the latest versions and master. In particular, for 21.12.4.1.

extern const int UNKNOWN_USER;
}
namespace
{
    AccessRights mixAccessRightsFromUserAndRoles(const User & user, const EnabledRolesInfo & roles_info)
    {
        AccessRights res = user.access;
        res.makeUnion(roles_info.access);
        return res;
    }
    AccessRights addImplicitAccessRights(const AccessRights & access)
    {
        auto modifier = [&](const AccessFlags & flags, const AccessFlags & min_flags_with_children, const AccessFlags & max_flags_with_children, const std::string_view & database, const std::string_view & table, const std::string_view & column) -> AccessFlags
        {
            size_t level = !database.empty() + !table.empty() + !column.empty();
            AccessFlags res = flags;
            
            static const AccessFlags create_table = AccessType::CREATE_TABLE;
            static const AccessFlags create_view = AccessType::CREATE_VIEW;
            static const AccessFlags drop_table = AccessType::DROP_TABLE;
            static const AccessFlags drop_view = AccessType::DROP_VIEW;
            static const AccessFlags alter_table = AccessType::ALTER_TABLE;
            static const AccessFlags alter_view = AccessType::ALTER_VIEW;
            if (res & create_table)
                res |= create_view;
            if (res & drop_table)
                res |= drop_view;
            if (res & alter_table)
                res |= alter_view;