[core][test] Add REST management query authorization support

[JingsongLi]

Purpose

Extract the non-Spark prerequisite from #9410 so the REST management runtime and test service can be reviewed independently.

Changes

• fail closed when managed row filters or column masks are invalid
• preserve nested projections while loading only selected mask dependencies
• add a REST management test service for permissions and policies
• keep assignments and policies consistent across resource and schema lifecycle changes
• use stable opaque pagination and serialize permission mutations with lifecycle operations
• document the fail-closed column allowlist evolution rule

Verification

• Core targeted tests: 13 passed
• REST OpenAPI validator: 56 catalog operations and 6 management operations
• Split mirror Spark procedure tests: 11 passed
• Every file changed by the original branch matches the recomposed split mirror
• git diff --check

This is a prerequisite for #9410 and contains no Spark connector changes.

[leaves12138]

Schema rollback bypasses the lifecycle validation added for policies and column permissions. This handler calls SchemaManager.rollbackTo directly, without validating the target schema, evolving assignments, refreshing tableMetadataStore, or serializing with the table/policy lifecycle locks. For example: create a query-auth table, add secret, create a column-mask policy on secret, then roll back to the schema before secret existed. The rollback currently succeeds, leaving the stored policy (and REST metadata) inconsistent with the actual schema. I reproduced this with a focused MockRESTCatalogTest; the expected rejection was not raised. Please apply the same target-schema validation/state update as alter/replace (or reject an incompatible rollback) and add a regression test.

[leaves12138]

The remaining concern is limited to the test REST server and is non-blocking. The production query-authorization and projection changes look good to me.