Fix subscription topic authorization bypass

[Caideyipi]

Summary

• bind subscription authorization to the authenticated RPC session user instead of the client-provided consumer username
• enforce READ_DATA for tree-model topics and SELECT for table-model subscriptions
• recheck authorization during subscribe, heartbeat, and polling so revoked privileges take effect immediately

The reported TRANSFER_SLICE allocation issue is already guarded on master by validating the received body size before allocating the original body buffer.

Verification

• mvn spotless:check -pl iotdb-core/datanode
• mvn checkstyle:check -pl iotdb-core/datanode
• git diff --check

[sonarqubecloud]

Quality Gate passed

Issues
20 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
2.4% Duplication on New Code

See analysis details on SonarQube Cloud

[codecov]

Codecov Report

❌ Patch coverage is 0% with 98 lines in your changes missing coverage. Please review.
✅ Project coverage is 43.60%. Comparing base (7e2c453) to head (ed94e55).

Files with missing lines	Patch %	Lines
.../db/subscription/agent/SubscriptionTopicAgent.java	0.00%	57 Missing ⚠️
.../subscription/receiver/SubscriptionReceiverV1.java	0.00%	33 Missing ⚠️
.../subscription/agent/SubscriptionReceiverAgent.java	0.00%	7 Missing ⚠️
.../db/protocol/thrift/impl/ClientRPCServiceImpl.java	0.00%	1 Missing ⚠️

Additional details and impacted files

@@             Coverage Diff              @@
##             master   #18418      +/-   ##
============================================
- Coverage     43.61%   43.60%   -0.02%     
  Complexity      374      374              
============================================
  Files          5393     5393              
  Lines        385958   386055      +97     
  Branches      50267    50297      +30     
============================================
- Hits         168337   168323      -14     
- Misses       217621   217732     +111     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[jt2594838]

Is it possible that the table name contains these chars?

[Caideyipi]

The database and table attributes in a table topic are regex patterns by contract (the same values are compiled by TablePattern). Therefore a metacharacter means the topic may cover multiple objects, and the conservative any-scope SELECT check is intentional. A literal name containing regex metacharacters must be escaped in the topic pattern; it is not interpreted as an unescaped literal table name.