ACT-1185: Expose standalone activity principals in Describe API (#882)

**What changed?**

Added new fields to read and return `start_by_principal`,
`close_by_principal` and `end_by_principal` to users by
`DescribeActivityExecution`.

**Why?**

This is to enable the read path for SAA Principal Attribute task -
https://temporalio.atlassian.net/browse/ACT-1185.

**Server PR**

temporalio/temporal#12550

Author: wenlong-gu

openapi/openapiv2.json

@@ -13938,6 +13938,18 @@
         "eagerExecutionAccepted": {
           "type": "boolean",
           "description": "Indicates whether eager execution was requested for this activity and accepted by the server\nfor its first task."
+        },
+        "startedByPrincipal": {
+          "$ref": "#/definitions/v1ResolvedPrincipal",
+          "description": "Authenticated principal by which this activity execution was started.\n"
+        },
+        "closedByPrincipal": {
+          "$ref": "#/definitions/v1ResolvedPrincipal",
+          "description": "Authenticated principal by which this activity execution was closed.\n"
+        },
+        "lastWorkerPrincipal": {
+          "$ref": "#/definitions/v1ResolvedPrincipal",
+          "description": "Authenticated principal of the worker that most recently interacted with this activity execution."
         }
       },
       "description": "Information about a standalone activity."
@@ -19338,6 +19350,20 @@
         }
       }
     },
+    "v1ResolvedPrincipal": {
+      "type": "object",
+      "properties": {
+        "type": {
+          "type": "string",
+          "description": "Low-cardinality category of the principal (e.g., \"jwt\", \"users\")."
+        },
+        "nameAtWriteTime": {
+          "type": "string",
+          "description": "Identifier within that category (e.g., sub JWT claim, email address).\n"
+        }
+      },
+      "description": "ResolvedPrincipal is a principal returned to an API caller."
+    },
     "v1RespondActivityTaskCanceledByIdResponse": {
       "type": "object"
     },

openapi/openapiv3.yaml

@@ -9924,6 +9924,26 @@ components:
           description: |-
             Indicates whether eager execution was requested for this activity and accepted by the server
              for its first task.
+        startedByPrincipal:
+          allOf:
+            - $ref: '#/components/schemas/ResolvedPrincipal'
+          description: |-
+            Authenticated principal by which this activity execution was started.
+
+             (-- api-linter: core::0140::prepositions=disabled
+                 aip.dev/not-precedent: "by" identifies the authenticated actor. --)
+        closedByPrincipal:
+          allOf:
+            - $ref: '#/components/schemas/ResolvedPrincipal'
+          description: |-
+            Authenticated principal by which this activity execution was closed.
+
+             (-- api-linter: core::0140::prepositions=disabled
+                 aip.dev/not-precedent: "by" identifies the authenticated actor. --)
+        lastWorkerPrincipal:
+          allOf:
+            - $ref: '#/components/schemas/ResolvedPrincipal'
+          description: Authenticated principal of the worker that most recently interacted with this activity execution.
       description: Information about a standalone activity.
     ActivityExecutionListInfo:
       type: object
@@ -15990,6 +16010,22 @@ components:
       properties:
         lastHeartbeatDetails:
           $ref: '#/components/schemas/Payloads'
+    ResolvedPrincipal:
+      type: object
+      properties:
+        type:
+          type: string
+          description: Low-cardinality category of the principal (e.g., "jwt", "users").
+        nameAtWriteTime:
+          type: string
+          description: |-
+            Identifier within that category (e.g., sub JWT claim, email address).
+
+             (-- api-linter: core::0140::prepositions=disabled
+                 aip.dev/not-precedent: Identifies the principal name snapshot used for this response. --)
+             (-- api-linter: core::0142::time-field-type=disabled
+                 aip.dev/not-precedent: This string is a principal name snapshot, not a timestamp. --)
+      description: ResolvedPrincipal is a principal returned to an API caller.
     RespondActivityTaskCanceledByIdRequest:
       type: object
       properties:

temporal/api/activity/v1/message.proto

@@ -203,6 +203,21 @@ message ActivityExecutionInfo {
     // Indicates whether eager execution was requested for this activity and accepted by the server
     // for its first task.
     bool eager_execution_accepted = 40;
+
+    // Authenticated principal by which this activity execution was started.
+    //
+    // (-- api-linter: core::0140::prepositions=disabled
+    //     aip.dev/not-precedent: "by" identifies the authenticated actor. --)
+    temporal.api.common.v1.ResolvedPrincipal started_by_principal = 41;
+
+    // Authenticated principal by which this activity execution was closed.
+    //
+    // (-- api-linter: core::0140::prepositions=disabled
+    //     aip.dev/not-precedent: "by" identifies the authenticated actor. --)
+    temporal.api.common.v1.ResolvedPrincipal closed_by_principal = 42;
+
+    // Authenticated principal of the worker that most recently interacted with this activity execution.
+    temporal.api.common.v1.ResolvedPrincipal last_worker_principal = 43;
 }
 
 // Limited activity information returned in the list response.

temporal/api/common/v1/message.proto

@@ -340,6 +340,19 @@ message Principal {
     string name = 2;
 }
 
+// ResolvedPrincipal is a principal returned to an API caller.
+message ResolvedPrincipal {
+    // Low-cardinality category of the principal (e.g., "jwt", "users").
+    string type = 1;
+    // Identifier within that category (e.g., sub JWT claim, email address).
+    //
+    // (-- api-linter: core::0140::prepositions=disabled
+    //     aip.dev/not-precedent: Identifies the principal name snapshot used for this response. --)
+    // (-- api-linter: core::0142::time-field-type=disabled
+    //     aip.dev/not-precedent: This string is a principal name snapshot, not a timestamp. --)
+    string name_at_write_time = 2;
+}
+
 // Priority contains metadata that controls relative ordering of task processing
 // when tasks are backed up in a queue. Initially, Priority will be used in
 // matching (workflow and activity) task queues. Later it may be used in history