## Summary

RTAS used a direct `tableCreator` string comparison instead of the
standard table authorization path. Route both RTAS phases through
`UPDATE_TABLE_METADATA` so the configured authorization handler
determines whether the requester is the table administrator.

UPDATE_TABLE_METADATA is only granted to the table admin / creator. 

## Changes

- [ ] Client-facing API Changes
- [ ] Internal API Changes
- [x] Bug Fixes
- [ ] New Features
- [ ] Performance Improvements
- [ ] Code Style
- [ ] Refactoring
- [ ] Documentation
- [x] Tests

Both staged replacement and replacement commit now use
`checkTableWritePathPrivileges` with `UPDATE_TABLE_METADATA`. This
reuses the same authorization path as other table writes and leaves
principal interpretation to the authorization implementation.

The replica check now uses null-safe enum equality so legacy tables
without an explicit `tableType` continue through the primary-table
authorization path.

Added coverage for staged replacement, replacement commit, authorized
and unauthorized metadata updates, and legacy tables without
`tableType`.

## Testing Done

- [ ] Manually Tested on local docker setup. Please include commands
ran, and their output.
- [x] Added new tests for the changes made.
- [ ] Updated existing tests to reflect the changes made.
- [ ] No tests added or updated. Please explain why. If unsure, please
feel free to ask for help.
- [ ] Some other form of testing like staging or soak time in
production. Please explain.

Ran the focused RTAS authorization tests and the complete
`IcebergSnapshotsServiceTest` class. The tests and `spotlessJavaCheck`
completed successfully.

# Additional Information

- [ ] Breaking Changes
- [ ] Deprecations
- [ ] Large PR broken into smaller PRs, and PR plan linked in the
description.

---------

Co-authored-by: mkuchenbecker <mkuchenbecker@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>