RANGER-5766: Add support for SPIFFE Ids as usernames in Ranger

[kumaab]

What changes were proposed in this pull request?

• SPIFFE IDs as usernames in Ranger.
• : allowed in usernames (config driven), and
• header/trusted-proxy authn resolves the full SPIFFE ID as the principal in both Ranger Admin and the PDP.

How was this patch tested?

Config prerequisites (Docker)

# Admin 
ranger.admin.authn.header.enabled=true
ranger.admin.authn.header.spiffe=X-Spiffe-Id
ranger.admin.spiffe.as.username.enabled=true
ranger.sso.enabled=true

# PDP 
ranger.pdp.authn.header.enabled=true
ranger.pdp.authn.header.spiffe=X-Spiffe-Id

• SPIFFE users are visible in Ranger UI:

• SPIFFE users participate in policy creation/update.

• PDP path

$ curl -sk -X POST http://localhost:6500/authz/v1/authorize \
  -H 'Content-Type: application/json' -H "X-Spiffe-Id: none" \
  -d "{\"requestId\":\"t6\",\"context\":{\"serviceName\":\"dev_hive\",\"serviceType\":\"hive\"},\"user\":{\"name\":\"$SID\"},\"access\":{\"resource\":{\"name\":\"database:default\"},\"action\":\"select\",\"permissions\":[\"select\"]}}" \
  -w '\nHTTP %{http_code}\n'
{"code":"UNAUTHORIZED","message":"Authentication required"}
HTTP 401

# Grant the full SPIFFE ID 'select' on database=default in dev_hive

$ SID='spiffe://spiffe.example.com/ns/sales/sa/trino'
$ curl -sk -X POST http://localhost:6500/authz/v1/authorize \
  -H 'Content-Type: application/json' -H "X-Spiffe-Id: $SID" \
  -d "{\"requestId\":\"t6\",\"context\":{\"serviceName\":\"dev_hive\",\"serviceType\":\"hive\"},\"user\":{\"name\":\"$SID\"},\"access\":{\"resource\":{\"name\":\"database:default\"},\"action\":\"select\",\"permissions\":[\"select\"]}}" \
  -w '\nHTTP %{http_code}\n'
{"requestId":"t6","decision":"ALLOW","permissions":{"select":{"permission":"select","access":{"decision":"ALLOW","policy":{"id":52,"version":1}}}}}
HTTP 200


$ SID='spiffe://spiffe.example.com/ns/sales/sa/ohau'
$ curl -sk -X POST http://localhost:6500/authz/v1/authorize \
  -H 'Content-Type: application/json' -H "X-Spiffe-Id: $SID" \
  -d '{"requestId":"t6","context":{"serviceName":"dev_hive","serviceType":"hive"},"user":{"name":"someoneelse"},"access":{"resource":{"name":"database:default"},"action":"select","permissions":["select"]}}' \
  -w '\nHTTP %{http_code}\n'
{"code":"FORBIDDEN","message":"spiffe://spiffe.example.com/ns/sales/sa/ohau is not authorized"}
HTTP 403