feat: Naive RBAC + Iceberg REST Catalog for Dremio OSS

[Copilot]

Two milestones closing critical production gaps in Dremio OSS: deny-by-default access control and external Iceberg catalog connectivity.

v1.0 — Naive RBAC

• Catalog enforcement: CatalogImpl.validatePrivilege() + isRbacDeniedForVds() — deny-by-default, gated behind services.rbac.enabled feature flag
• SQL DDL: CREATE/DROP ROLE, GRANT/REVOKE ROLE TO USER, GRANT/REVOKE SELECT/EXECUTE ON VDS/FUNCTION — wired up existing parser stubs (no grammar changes)
• Persistence: 3 RocksDB KV stores under oss_rbac_ prefix (roles, memberships, grants); role IDs = slugified names
• REST API: 9 admin-only endpoints at /api/v3/rbac
• Visibility filtering: v2 + v3 catalog REST APIs hide ungrant­ed VDS/UDFs from non-admins
• Observability: sys.roles, sys.privileges, sys.membership system tables
• Bypass fixes (post-audit): bulkGetTables() and getTable(CatalogEntityKey) AT-specifier path both lacked RBAC checks — patched

v1.1 — Iceberg REST Catalog

• Plugin wiring: @SourceType(value="RESTCATALOG") on RestIcebergCatalogPluginConfig — makes the existing plugin discoverable by ConnectionReaderImpl.getCandidateSources()
• UI form: restcatalog-layout.json — 3-tab form covering endpoint, namespaces, properties, credentials, caching
• Validated: source creation, namespace browsing, table listing, SELECT — against both Lakekeeper and Nessie

Known gaps

ID	Issue	Workaround
CONN-03	Vended credentials from loadTable() discarded in DremioFileIO; fix point: AbstractRestCatalogAccessor.getTableHandleInternal():376–407	Static fs.s3a.* in propertyList — works for long-lived creds, fails for IAM/STS
—	hasAccessPermission() is a no-op — all users have full read on REST catalog tables	Deferred to future RBAC integration milestone

---

🔒 GitHub Advanced Security automatically protects Copilot coding agent pull requests. You can protect all pull requests by enabling Advanced Security for your repositories. Learn more about Advanced Security.