Core: Support client-configured encryption in RESTCatalog (test-only backport of apache/iceberg#13225 to 1.12.0)

[nevzheng]

Requested by Nevin

Summary

A test-only Iceberg 1.12.0 build whose REST client encrypts. Stock Iceberg REST clients write keyed tables in
plaintext (datastrato/gravitino-enterprise#2249), so Datastrato's acceptance tests cannot show encrypted data through
Gravitino's Iceberg REST catalog. This branch applies apache/iceberg#13225 to the 1.12.0 release so loom's test image can
run encrypted round trips. It is not customer availability: customers need an upstream release with the fix.

Changes

• Backport of Core: Support client-configured encryption in RESTCatalog apache/iceberg#13225 (net diff of its head 441d6b52): RESTSessionCatalog creates a
  KeyManagementClient from the catalog's encryption.kms-type or encryption.kms-impl, and RESTTableOperations uses
  a standard encryption manager and an encrypting FileIO for keyed tables. The REST test-catalog cases join the Spark
  4.1 encryption suites.
• Conflicts with 1.12.0, resolved by keeping 1.12.0's new readQueryParams argument and adding the KMS client
  argument beside it: RESTSessionCatalog, RESTTableOperations, TestFreshnessAwareLoading.
• Version 1.12.0-ds.1 (version.txt), so the build never collides with the real 1.12.0.
• Base ds/1.12.0-base is apache-iceberg-1.12.0 plus one commit that removes upstream's GitHub workflows, so
  nothing runs on push or pull request. Build and test locally.

Verification

Run locally with Gradle, JDK 17, from this branch:

Suite	Tests	Failures	Skipped
core TestRESTCatalog	210	0	6
core TestFreshnessAwareLoading	25	0	0
core encryption (manifests, manifest lists, key parser and serialization, ciphers, EncryptionUtil, Avro split)	58	0	2
Spark 4.1 TestTableEncryption (16 REST-catalog cases)	32	0	1
Spark 4.1 TestCTASEncryption	4	0	0

• A combined run made every Spark encryption case fail, Hive included, because the embedded test metastore dropped
  connections under parallel load. Run alone, all pass.
• The runtime jar iceberg-spark-runtime-4.1_2.13-1.12.0-ds.1.jar is built from this branch and records it in
  iceberg-build.properties.

Related work

Related to: datastrato/gravitino-enterprise#2382, datastrato/gravitino-enterprise#2249, apache/iceberg#13225
Used by: datastrato/loom#721

🤖 Generated with Claude Code