[CDAP-21211] Authenticate Preview Runner to Preview Manager communication done via CDAP Messaging Service

[sidhdirenge]

This change authenticates messages sent from a PreviewRunner to the PreviewManager to ensure a runner can only update its own assigned preview run.

Key Changes:

• Enhanced PreviewRequestPollerInfo: A secretToken field has been added to act as a session password. This is generated in PreviewRunnerTwillRunnable at the start of the runner's lifecycle
• Authenticated Messages: The serialized PreviewRequestPollerInfo (as publisherInfo) is now attached to every PreviewMessage sent from the runner.
• Strict Validation: The PreviewDataSubscriberService now validates the publisherInfo in every message against the record in the PreviewStore. A mismatch results in message rejection and termination of the offending runner

Guice Dependency Issue:

To accommodate differences between distributed and non-distributed modes, the following design was used to propagate the pollerInfo.

The Challenge: The pollerInfo (with the secretToken) is generated only in the distributed environment within PreviewRunnerTwillRunnable. However, it's needed by generic components like PreviewMessage(which stores the runner info now) to create the DefaultPreviewRunner and DefaultDataTracer which are created without direct knowledge of the distributed-only class.

The Solution: To decouple the components, the publisherInfo is not injected at construction. Instead, it's set explicitly at runtime (e.g., during the startPreview call), allowing the generic components to support both modes while enabling the new authentication mechanism in the distributed environment.

Testing:

• Quickstart pipeline run
• One runner tries to update preview run associated to different runner

• Secret token is different for the same runner

• Unit tests validating cdap sandbox preview run

[sonarqubecloud]

Quality Gate failed

Failed conditions
27.5% Coverage on New Code (required ≥ 80%)

See analysis details on SonarQube Cloud