[doc](auth) Add guide for writing a custom authorization plugin

[arpitjain099]

Doris has supported external authorization through the AccessControllerFactory / CatalogAccessController SPI since #40750, with Apache Ranger as the reference implementation, but there is no page documenting the SPI itself. Today anyone who wants to back Doris authorization with a different system (OPA, OpenFGA, an in-house entitlement service) has to reverse-engineer it from the Ranger code.

This adds admin-manual/auth/authorization/custom.md alongside the existing internal and Ranger authorization docs, and links it into the sidebar. It covers:

• the two interfaces you implement, CatalogAccessController and AccessControllerFactory, with the actual method signatures and the parts worth knowing up front (the hasGlobal default overloads, checkColsPriv throwing AuthorizationException instead of returning a boolean, and masking/row-filter returning empty by default)
• the two ways Doris discovers a factory: the classpath META-INF/services file for an in-tree plugin, and the external plugin directory for a standalone jar
• how a controller is selected and configured, for both the internal catalog (access_controller_type + authorization_config_file_path) and external catalogs (access_controller.class + access_controller.properties.*)
• a minimal skeleton to start from, plus a pointer to the Ranger integration as the worked example

All interface signatures and config keys were checked against the current fe-core source. This also gives external-authorizer work like the OpenFGA controller in #65685 a place to point its readers.

Notes on versions and languages: the page is added to the current (dev) docs and in English first. The SPI has existed since 3.0, so this can be backported to the 3.x and 4.x versioned docs and translated to Chinese / Japanese as follow-ups. Happy to fold those into this PR instead if you would prefer them together.

Versions

• dev
• 4.x
• 3.x
• 2.1 or older (not covered by version/language sync gate)

Languages

• Chinese
• English
• Japanese candidate translation needed

Docs Checklist

• Checked by AI
• Test Cases Built
• Updated required version and language counterparts, or explained why not
• If only one language changed, confirmed whether source/translation counterparts need sync