HIVE-29248: Propagate HiveAccessControlException to HiveCatalog

[okumin]

What changes were proposed in this pull request?

Add a prefixed message, Got exception: org.apache.hadoop.hive.ql.security.authorization.plugin.HiveAccessControlException, to MetaException when HiveMetaStoreAuthorizer handles HiveAccessControlException, and make HiveCatalog translate it to Iceberg's ForbiddenException.

This Pull Request implements the first option in the following document, and I'm not obsessed with this option; I chose it first because the change is minimal(easy to revert). I'm open to Option 2 or 3, or another suggestion.
https://docs.google.com/document/d/1SMvIud9k5lVSzqjgCzohHH59oW5MWAwA9BW-pPr9yIc/edit?usp=sharing

https://issues.apache.org/jira/browse/HIVE-29248

Why are the changes needed?

Currently, when Ranger rejects an access, HiveMetastore throws MetaException(message:<Message thrown by Ranger>), and a Thrift client can't get more information than the error message implemented in Apache Ranger. It's inconvenient for an Iceberg client such as Spark to distinguish the root cause and Iceberg REST API can't return a proper status code, i.e., 403.

Does this PR introduce any user-facing change?

No. The error message will contain more information.

How was this patch tested?

I added integration tests to verify that thrown exceptions are handled correctly.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[deniskuzZ]

+1, pending tests

[okumin]

I verified that a client would see a ForbiddenException for sure

trino> select * from iceberg.default.test;
Query 20251205_083416_00005_ntu85 failed: Failed to load view 'test'
io.trino.spi.TrinoException: Failed to load view 'test'
	at io.trino.plugin.iceberg.catalog.rest.TrinoRestCatalog.getIcebergView(TrinoRestCatalog.java:715)
	at io.trino.plugin.iceberg.catalog.rest.TrinoRestCatalog.getView(TrinoRestCatalog.java:686)
	at io.trino.plugin.iceberg.IcebergMetadata.getView(IcebergMetadata.java:3272)
...
Caused by: org.apache.iceberg.exceptions.ForbiddenException: Forbidden: Access denied: Got exception: org.apache.hadoop.hive.ql.security.authorization.plugin.HiveAccessControlException Permission denied: user [trino] does not have [SELECT] privilege on [default/test]
	at org.apache.iceberg.rest.ErrorHandlers$DefaultErrorHandler.accept(ErrorHandlers.java:236)

[okumin]

Merged. @deniskuzZ Thanks for reviewing this PR!

[Chaho12]

@okumin Hi, I have a question regarding this PR.
Does this change propagate authorization-related errors to Trino as a ForbiddenException?

I ran into an issue with using StorageBasedAuthorizationProvider where AccessControlExceptions were not propagated to the client immediately, causing the request to wait until the metastore timeout.
Here is the fix, not pretty, but I had no choice.

[okumin]

@Chaho12
This patch does not directly help your issue. Your issue likely occurs when you use the Hive connector, which lets Trino access Hive's Thrift API. HIVE-29248 would make Hive's Iceberg REST API return a ForbiddenException. The Thrift API still returns a MetaException, with the message slightly changed.