ADH-8178: add gRPC authentication between Kyuubi server and Spark engine

[werzerbb]

Summary

Added token authentication to gRPC connection Kyuubi server uses to talk to Spark engine
(Spark Connect), extending the existing kyuubi.engine.security.enabled AES-encrypted-token auth
that earlier only covered Thrift connection.

What was added

• KyuubiEngineTokenServerInterceptor (engine side): rejects gRPC calls missing a valid
  x-kyuubi-engine-token header. Registered on engine's Spark Connect service only when
  kyuubi.engine.security.enabled=true.
• KyuubiEngineTokenClientInterceptor (Kyuubi server side): attaches a fresh
  InternalSecurityAccessor-issued token to outgoing gRPC call.
• Auto-provisioned ZK secret: the shared secret node
  (kyuubi.ha.zookeeper.engine.secure.secret.node, default /kyuubi_engine_secure_secret) is now
  auto-created with a random secret on first use. Disable with new option
  kyuubi.ha.zookeeper.engine.secure.secret.node.auto-create=false to provision it manually.

New config options

Key	Default	Description
kyuubi.ha.zookeeper.engine.secure.secret.node.auto-create	true	Auto-create the engine security secret ZK node with a randomly generated secret if it doesn't exist yet; set to false to require manual provisioning

Changed config defaults

• kyuubi.ha.zookeeper.engine.secure.secret.node now defaults to /kyuubi_engine_secure_secret
  (previously had no default and required manual configuration)

Manual secret provisioning (when auto-create is disabled)

With kyuubi.ha.zookeeper.engine.secure.secret.node.auto-create=false, the ZK secret node must be
created before starting Kyuubi. The secret should be at least
kyuubi.engine.security.crypto.keyLength / 8 characters (16 for the default 128-bit key)

see an example:

# Generate a 16-character secret (matches default 128-bit key length)
SECRET=$(tr -dc 'A-Za-z0-9' </dev/urandom | head -c16)

# Create node ZK-side
/usr/lib/zookeeper/bin/zkCli.sh create /arenadata/cluster/11/kyuubi_engine_secure_secret "$SECRET"

Alternatively, skip ZooKeeper entirely with the static simple provider - set the same secret on
each Kyuubi server:

kyuubi.engine.security.secret.provider=simple
kyuubi.engine.security.secret.provider.simple.secret=<the same secret on server>