[api][spark] Add REST permission and data policy management - #9377

Purpose

Add an experimental, language-neutral REST management contract for permission assignments and table data policies, and expose it to Spark through catalog procedures. Management is provided directly by RESTCatalog without changing the generic Catalog interface.

Permission paths are /v1/{prefix}/permissions, /grant, and /revoke. Row-filter and column-mask policies are attached below /v1/{prefix}/databases/{database}/tables/{table}/policies. Here prefix is the REST Catalog server prefix, not a catalog name or catalog identifier in the permission hierarchy.

Data policies only restrict reads that the caller is already authorized to perform; they do not grant table access.

Changes

• Add structured permission resources, principals, scopes, access types, assignments, and idempotent grant/revoke operations.
• Add row-filter and column-mask policies backed by named functions, typed arguments, principal targeting, and exception principals.
• Add public permission and policy methods to RESTApi, and expose permissionManagement() and policyManagement() directly from RESTCatalog.
• Add Spark CALL procedures for granting, listing, and revoking permissions, and for creating, replacing, listing, and dropping data policies.
• Preserve the existing PagedList contract: each list call returns one page, and an empty page terminates pagination.
• Add stable permission ordering, inherited-permission projection, atomic assignment replacement, and unsafe-request retry protection.
• Key policies by stable table UUID, preserve them across rename, remove them on drop, and serialize policy changes with schema and table lifecycle operations.
• Reject schema changes that disable query authorization or invalidate policy functions, arguments, or referenced columns.
• Add an OpenAPI 3.1 management specification, contract validation, and expanded REST/Spark usage documentation.

Tests

• mvn -pl paimon-api -Dtest=PermissionManagementJsonTest,RESTPolicyManagementTest,RESTPermissionManagementTest,HttpClientRetrySafetyTest,RequestJacksonCompatibilityTest test
• mvn -pl paimon-core -am -Dtest=RESTPermissionStoreTest,ResourcePathsTest -Dsurefire.failIfNoSpecifiedTests=false test
• mvn -pl paimon-spark/paimon-spark-ut -am -DwildcardSuites=org.apache.paimon.spark.procedure.PermissionProcedureTest -Dtest=__NoSuchTest__ -Dsurefire.failIfNoSpecifiedTests=false test
• mvn -pl paimon-spark/paimon-spark-ut -am '-Dtest=SparkCatalogWithRestTest#testRowFilter+testColumnMaskingAndRowFilter' -DwildcardSuites=__NoSuchSuite__ -Dsurefire.failIfNoSpecifiedTests=false test
• node docs/scripts/validate-rest-openapi.js