[vyommani]

What changes were proposed in this pull request?

RANGER-5858: return constraints (RANGER-5848) in the authz API result, so PDP and authz API callers such as the Agent Harness receive constraints like requireApproval.

• RangerAuthzResult.ConstraintResult: name, parameters, policy (id, version), policyPriority.
• constraints on ResultInfo and PermissionResult, next to dataMask and rowFilter; each permission and sub-resource result carries its own. Left out of the JSON when empty.
• RangerAuthzPlugin copies RangerAccessResult.getConstraints() into the result when access is allowed, sorted with RangerConstraintResult.CONSTRAINT_RESULT_COMPARATOR. No constraints are returned on deny or when access is not determined.
• authz-api does not depend on agents-common types, so the match type is not returned.

The policy engine populates constraints only after RANGER-5842, so until then the response doesn't change.

Not in this change: the caller declaring supported constraints and deny-if-unsupported , and audit.

How was this patch tested?

• TestRangerAuthzResult (authz-api): PermissionResult copies constraints from ResultInfo; equals and hashCode include them; ConstraintResult accessors and equality.
• TestRangerAuthzPluginConstraints (authz-embedded):
  • allowed: constraints returned, sorted by name, then OVERRIDE before NORMAL, then policy id;
  • none when nothing matched, on deny, and when access is not determined;
  • parameters are copied;
  • JSON round-trip of RangerAuthzResult with constraints, and the field omitted when empty.
• mvn -pl authz-api,authz-embedded -am checkstyle:check test