Add hive.kerberos-service-host configuration option

[brightwon]

Closes #3787

Rationale for this change

The Hive catalog derives the Kerberos SASL host (the hostname component of the service principal) from the metastore URI, with no way to override it. Authentication therefore fails whenever the service principal's hostname component differs from the host being connected to, for example in an HA setup where uri has to list the real metastore hosts while the principal uses a single fixed hostname.

This adds an optional hive.kerberos-service-host property, mirroring the existing hive.kerberos-service-name for the service component. When it is not set, the URI host is used, so existing behavior is unchanged.

Are these changes tested?

Yes.

• test_create_hive_client_with_kerberos_service_host verifies the property is passed through to _HiveClient.
• test_kerberized_client_uses_configured_service_host verifies at the transport level that the SASL host is the configured value, and falls back to the URI host when the property is not set.
• The existing _create_hive_client assertions were updated for the new argument.

I also verified it end-to-end against a Hive Metastore with Kerberos: without the property the connection fails with a KDC LOOKING_UP_SERVER error, and with it the correct service ticket is issued and the catalog works.

Are there any user-facing changes?

Yes, a new optional Hive catalog property hive.kerberos-service-host. It defaults to the metastore URI host, so there is no change for existing users. The documentation table has been updated.