[KYUUBI #7549] Fix Subject.getSubject() in Kyuubi JDBC driver for JDK 25 compatibility

[turboFei]

Why are the changes needed?

JDK 24 permanently disabled the Security Manager (JEP 486), making AccessController.getContext() throw UnsupportedOperationException. JDK 25 extended this to Subject.getSubject(). These APIs are called in the Kyuubi JDBC driver during Kerberos authentication, causing connections to fail:

java.lang.UnsupportedOperationException: getSubject is not supported
    at java.base/javax.security.auth.Subject.getSubject(Subject.java)

Additionally, Subject.doAs() is deprecated for removal (JEP 411) and will break in a future JDK release.

Fixes #7549.

What changed

Added SubjectUtil to kyuubi-hive-jdbc, ported from Apache Hadoop (HADOOP-19212, HADOOP-19906). It bridges the deprecated/removed Security Manager APIs to their JDK 18+ replacements using MethodHandle lookups resolved once at class load time:

• Subject.getSubject(AccessController.getContext()) → Subject.current() (JDK 18+)
• Subject.doAs() → Subject.callAs() (JDK 18+)
• On JDK 22+, maintains an InheritableThreadLocal<Subject> to restore pre-JDK 22 Subject propagation into newly constructed threads (HADOOP-19906)
• Falls back to the old APIs on JDK < 18 transparently

Updated all affected callsites in the JDBC driver:

File	Change
KyuubiConnection.java	Subject.getSubject() × 2 → SubjectUtil.current()
HttpAuthUtils.java	Subject.doAs() → SubjectUtil.doAs()
TSubjectTransport.java	Subject.doAs() → SubjectUtil.doAs()

How was this patch tested?

Ported TestSubjectUtil from Apache Hadoop, covering exception propagation semantics of callAs(), doAs(PrivilegedAction), doAs(PrivilegedExceptionAction), and sneakyThrow() across JDK versions. Full kyuubi-hive-jdbc unit suite (43 tests) passes.

Was this patch authored or co-authored using generative AI tooling?

Assisted-by: Claude:claude-sonnet-4-6

[turboFei]

Works locally

[pan3793]

lgtm, verified the port is correct. just leave some comments.