`AddDefaultDatabaseVisitor::visit(ASTSelectQuery &, ASTPtr &)` guards its
WITH-traversal on `select.recursive_with` but then dereferences
`select.with()->children` unconditionally. The parser sets the flag together with
a non-empty WITH expression, but AST mutation after parsing (server-side
`BuzzHouse` fuzzing, in particular) can leave the flag set while the expression
is absent, producing a null pointer dereference inside `IStorageCluster::read`.
Surfaced by `BuzzHouse (amd_tsan)` as `STID: 3440-3393` on PRs ClickHouse#104969 and
ClickHouse#105332 (two unrelated PRs in five days).

Guard the dereference with the actual presence of the WITH expression, matching
the pattern already used in `ASTSelectQuery::formatImpl` and
`QueryTreeBuilder::buildSelectQuery`. Valid `WITH RECURSIVE x AS ...` queries
are unaffected.

Adds a `gtest` that constructs the inconsistent AST shape, runs the visitor, and
asserts no fatal failure; the test reliably aborts on the previous code with the
`boost::intrusive_ptr` null-deref assertion.

Closes ClickHouse#105370

CI report: https://s3.amazonaws.com/clickhouse-test-reports/json.html?PR=105332&sha=ac51d1463d5def7f7ba0354f581e078cbf10d6c6&name_0=PR&name_1=BuzzHouse%20%28amd_tsan%29

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>