[MOVED] feat(kms): Add Transit key inspection clients

[nevzheng]

Moved to Gravitino Enterprise: datastrato/gravitino-enterprise#900. Apache issue #12131 is now limited to the provider-neutral API/SPI and named-source routing.

What changes were proposed in this pull request?

Add separate OpenBao Transit and HashiCorp Vault Transit providers using typed HTTP request and response objects, pooled HTTP clients, token-file authentication, strict endpoint configuration, and normalized key properties.

Missing keys, rejected authentication, malformed responses, and unavailable services remain distinct outcomes.

Why are the changes needed?

Transit provides an open, locally testable implementation of the common KMS contract while allowing OpenBao and Vault integrations to evolve independently.

This work is now tracked in datastrato/gravitino-enterprise#900. The Apache OSS foundation remains #12132 and #12133.

Does this PR introduce any user-facing change?

Yes. It adds the openbao-transit and vault-transit KMS APIs and their source properties.

How was this patch tested?

• ./gradlew :bundles:transit:check -PskipITs

Migration

• Enterprise epic: datastrato/gravitino-enterprise#899
• Enterprise PR: datastrato/gravitino-enterprise#900
• OSS foundation: [EPIC] Add provider-neutral KMS interfaces #12131, [#12131] feat(kms): Define key inspection API #12132, and [#12131] feat(kms): Configure and route named sources #12133

[nevzheng]

Hi @roryqi and @asdf1234 — please review this KMS API change (3/11). Previous: #12133. Next: #12135. Epic: #12131.

[github-actions]

Code Coverage Report

Overall Project	67.94% +0.04%	🟢
Files changed	72.35%	🟢

Module	Coverage
aliyun	1.72%	🔴
api	48.25% +0.43%	🟢
authorization-common	85.96%	🟢
aws	42.04%	🟢
azure	2.47%	🔴
catalog-common	9.92%	🔴
catalog-fileset	79.74%	🟢
catalog-glue	66.91%	🟢
catalog-hive	79.4%	🟢
catalog-jdbc-common	45.7%	🟢
catalog-jdbc-doris	81.72%	🟢
catalog-jdbc-mysql	79.33%	🟢
catalog-jdbc-postgresql	83.39%	🟢
catalog-jdbc-starrocks	79.16%	🟢
catalog-kafka	77.01%	🟢
catalog-lakehouse-generic	59.18%	🟢
catalog-lakehouse-hudi	79.1%	🟢
catalog-lakehouse-iceberg	85.86%	🟢
catalog-lakehouse-paimon	84.23%	🟢
catalog-model	77.72%	🟢
cli	44.5%	🟢
client-java	78.27%	🟢
common	51.95%	🟢
core	82.67% -0.41%	🟢
filesystem-hadoop3	77.28%	🟢
flink	0.0%	🔴
flink-common	47.09%	🟢
flink-runtime	0.0%	🔴
gcp	14.12%	🔴
hadoop-auth	68.0%	🟢
hadoop-common	12.7%	🔴
hive-metastore-common	53.4%	🟢
iceberg-common	64.65%	🟢
iceberg-rest-server	74.91%	🟢
idp-basic	86.02%	🟢
integration-test-common	0.0%	🔴
jobs	66.17%	🟢
lance-common	20.67%	🔴
lance-rest-server	64.84%	🟢
lineage	53.02%	🟢
optimizer	83.24%	🟢
optimizer-api	21.95%	🔴
server	85.92%	🟢
server-common	76.12%	🟢
spark	28.57%	🔴
spark-common	46.01%	🟢
tencent	69.84%	🟢
transit	90.75%	🟢
trino-connector	40.29%	🟢

Files

Module	File	Coverage
api	KmsApi.java	100.0%	🟢
	KmsClient.java	100.0%	🟢
	KmsReference.java	100.0%	🟢
	KmsAuthenticationException.java	0.0%	🔴
	KmsClientFactory.java	0.0%	🔴
	KmsConfigurationException.java	0.0%	🔴
	KmsKeyProperties.java	0.0%	🔴
core	KmsConfig.java	100.0%	🟢
	KmsClientRegistry.java	98.88%	🟢
	GravitinoEnv.java	20.93%	🔴
transit	OpenBaoTransitKmsKeyProperties.java	100.0%	🟢
	TransitKeyData.java	100.0%	🟢
	TransitReadKeyResponse.java	100.0%	🟢
	VaultTransitKmsKeyProperties.java	100.0%	🟢
	OpenBaoTransitKmsClient.java	97.3%	🟢
	OpenBaoTransitKmsClientFactory.java	91.23%	🟢
	VaultTransitKmsClientFactory.java	91.23%	🟢
	TransitApiClient.java	90.22%	🟢
	TransitReadKeyRequest.java	83.33%	🟢
	VaultTransitKmsClient.java	82.35%	🟢
	FileTokenSupplier.java	81.48%	🟢

[nevzheng]

Moved to datastrato/gravitino-enterprise#900 under enterprise epic #899. Apache OSS scope remains #12132 and #12133 under #12131.