RANGER-5628/RANGER-5667: Backport Ozone action policy support and follow-on fixes to ranger-2.9

[ramackri]

Summary

• Backports RANGER-5628 (#995) / commit dcf5947fe to the ranger-2.9 release branch.
• Adds Ozone STS action-based policy evaluation (RangerActionMatcher, RangerActionListMatcher) and UI support for action conditions on permission rows.
• Bumps ozone.version from 2.1.0 to 2.1.1 (required for RequestContext.getS3Action() and OzoneGrant.getS3Actions() APIs).
• Includes follow-on backport of RANGER-5667 (#1053) / commit 9bf7a9364 as a second commit on this branch.

RANGER-5667 follow-on fixes

• Deny when action is missing: If a policy condition has action-matches restrictions but the request does not supply an s3Action, the request is now denied (previously incorrectly allowed).
• Whitespace-only actions: A non-empty action list containing only whitespace is now treated as no action restrictions.
• Avoid unnecessary allocation: RangerActionMatcher no longer eagerly constructs a default RangerActionListMatcher.
• UI crash fix: usePruneStaleConditions.js now guards against undefined policy items when adding Allow/Deny conditions in the Ozone policy UI.

Backport conflict resolutions

• RangerOzoneAuthorizer.java: Kept ranger-2.9 logging/style; applied only the functional change to pass context.getS3Action() as the request action.
• Editable.jsx / PolicyConditionsComp.jsx: Took master UI refactor (fixes React hooks violations, adds action-matches support).
• checkstyle-suppressions.xml: Kept ranger-2.9 minimal suppressions; added only the new patch class suppression.
• GovernedData views (AccessGrantForm.jsx, DatashareDetailLayout.jsx): Dropped — these files do not exist on ranger-2.9 (GDS UI not present in this branch).
• RANGER-5667 cherry-pick: Applied cleanly on top of the RANGER-5628 backport commit with no manual conflict resolution required.

Potential risk areas for ranger-2.9

• Ozone dependency bump (2.1.0 → 2.1.1): Required for compilation and runtime STS action APIs. Deployments must use Ozone 2.1.1+ for full action support.
• DB patch PatchForOzoneServiceDefPolicyConditionUpdate_J10065: Will run on Ranger admin startup to add the action-matches policy condition to the Ozone service definition.
• React UI changes in Editable.jsx: Large refactor; recommend manual UI testing of Ozone policy create/edit flows.
• RANGER-5667 behavior change: Requests without s3Action against policies with action restrictions will now be denied. Verify this matches expected Ozone STS authorization behavior.

Test plan

• mvn -pl agents-common,plugin-ozone,security-admin -am test compiles and unit tests pass
• Ozone policy UI: create/edit policy with action-matches on permission rows
• Ozone policy UI: add Allow/Deny conditions without UI crash (RANGER-5667)
• Ozone STS end-to-end: verify action-based authorization with Ranger docker + Ozone 2.1.1
• Ozone STS end-to-end: verify requests without s3Action are denied when policy has action restrictions (RANGER-5667)
• Verify DB patch applies cleanly on upgrade from existing ranger-2.9 install