Improve ACL 2.0 authorization context handling

[dingshuangxi888]

This PR improves ACL 2.0 authorization context handling for remoting and gRPC requests while preserving compatibility with existing request shapes.

[RockteMQ-AI]

Summary

This PR significantly improves ACL 2.0 authorization context handling for both remoting and gRPC protocols while preserving backward compatibility. The changes are well-structured with comprehensive test coverage.

Key improvements:

• Backward compatibility layer (AuthorizationCompatibility): Gracefully handles legacy request shapes that may not have explicit authorization contexts, preventing breakage for existing deployments
• Input validation: requireResource() and decodeRequiredBody() helpers ensure non-null/non-blank values and proper body decoding, closing potential bypass vectors
• Extended request coverage: Many new request codes are now properly handled (BATCH_ACK_MESSAGE, QUERY_ASSIGNMENT, SET_MESSAGE_REQUEST_MODE, etc.)
• Security hardening: Retry topic validation against consumer group prevents authorization bypass; empty contexts now properly rejected when compatibility doesn't match
• Comprehensive tests: Excellent test coverage including edge cases for compatibility matching, null handling, and resource pattern validation

Overall: Solid improvement to the authorization system. The code is clean, well-tested, and maintains backward compatibility.

---

Automated review by github-manager-bot

[RockteMQ-AI]

The catch (Throwable ignored) block silently swallows all exceptions. This is a deliberate defensive pattern for backward compatibility, but consider adding a brief comment explaining why all throwables are caught (e.g., 'catch-all to avoid breaking existing request flows when compatibility detection itself fails'). This helps future maintainers understand the intent and not 'fix' it away.

[RockteMQ-AI]

The behavior change from silently allowing empty contexts to throwing AuthorizationException is a security improvement. However, this could affect existing deployments that rely on the old pass-through behavior. Consider noting this in the PR description or commit message as a breaking change for operators who have ACL enabled but send requests without proper context building.

[codecov-commenter]

Codecov Report

❌ Patch coverage is 83.43373% with 55 lines in your changes missing coverage. Please review.
✅ Project coverage is 48.56%. Comparing base (7eee0fc) to head (422c3ab).

Files with missing lines	Patch %	Lines
...on/builder/DefaultAuthorizationContextBuilder.java	84.01%	23 Missing and 16 partials ⚠️
...auth/authorization/AuthorizationCompatibility.java	77.50%	4 Missing and 5 partials ⚠️
...cketmq/broker/processor/QueryMessageProcessor.java	85.71%	0 Missing and 4 partials ⚠️
...tmq/auth/authorization/AuthorizationEvaluator.java	81.25%	2 Missing and 1 partial ⚠️

Additional details and impacted files

@@              Coverage Diff              @@
##             develop   #10925      +/-   ##
=============================================
+ Coverage      48.45%   48.56%   +0.10%     
- Complexity     13588    13673      +85     
=============================================
  Files           1380     1381       +1     
  Lines         101196   101464     +268     
  Branches       13130    13187      +57     
=============================================
+ Hits           49038    49276     +238     
- Misses         46190    46193       +3     
- Partials        5968     5995      +27     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.