[MOVED] test(azure): Cover Key Vault metadata end to end

[nevzheng]

Moved to Gravitino Enterprise: datastrato/gravitino-enterprise#907. Apache issue #12131 is now limited to the provider-neutral API/SPI and named-source routing.

What changes were proposed in this pull request?

Add an explicitly enabled, read-only Azure Key Vault integration test covering a pinned key version, the latest version, and a missing key. The README documents fixture ownership, DefaultAzureCredential flows, least-privilege access, and the skip/failure boundary.

Why are the changes needed?

Azure has no supported local Key Vault emulator. The opt-in live test validates the SDK and service contract without provisioning or mutating resources.

This work is now tracked in datastrato/gravitino-enterprise#907. The Apache OSS foundation remains #12132 and #12133.

Does this PR introduce any user-facing change?

No production behavior changes. It adds integration tests and testing documentation.

How was this patch tested?

• ./gradlew :bundles:azure:test -PskipITs
• The no-fixture skip path is deterministic; live validation requires GRAVITINO_AZURE_KMS_IT=true and the documented fixtures.

Migration

• Enterprise epic: datastrato/gravitino-enterprise#899
• Enterprise PR: datastrato/gravitino-enterprise#907
• OSS foundation: [EPIC] Add provider-neutral KMS interfaces #12131, [#12131] feat(kms): Define key inspection API #12132, and [#12131] feat(kms): Configure and route named sources #12133

[nevzheng]

Hi @roryqi and @lasdf1234 — please review this KMS API change (10/11). Previous: #12140. Next: #12142. Epic: #12131.

[github-actions]

Code Coverage Report

Overall Project	68.06% +0.15%	🟢
Files changed	79.72%	🟢

Module	Coverage
aliyun	1.72%	🔴
api	48.25% +0.43%	🟢
authorization-common	85.96%	🟢
aws	51.64% +9.61%	🟢
azure	47.32% +44.85%	🟢
catalog-common	9.92%	🔴
catalog-fileset	79.74%	🟢
catalog-glue	66.91%	🟢
catalog-hive	79.4%	🟢
catalog-jdbc-common	45.7%	🟢
catalog-jdbc-doris	81.72%	🟢
catalog-jdbc-mysql	79.33%	🟢
catalog-jdbc-postgresql	83.39%	🟢
catalog-jdbc-starrocks	79.16%	🟢
catalog-kafka	77.01%	🟢
catalog-lakehouse-generic	59.18%	🟢
catalog-lakehouse-hudi	79.1%	🟢
catalog-lakehouse-iceberg	85.93%	🟢
catalog-lakehouse-paimon	84.23%	🟢
catalog-model	77.72%	🟢
cli	44.5%	🟢
client-java	78.27%	🟢
common	51.95%	🟢
core	82.67% -0.41%	🟢
filesystem-hadoop3	77.28%	🟢
flink	0.0%	🔴
flink-common	47.09%	🟢
flink-runtime	0.0%	🔴
gcp	47.02% +32.9%	🟢
hadoop-auth	68.0%	🟢
hadoop-common	12.7%	🔴
hive-metastore-common	53.4%	🟢
iceberg-common	64.65%	🟢
iceberg-rest-server	74.99%	🟢
idp-basic	86.02%	🟢
integration-test-common	0.0%	🔴
jobs	66.17%	🟢
lance-common	20.67%	🔴
lance-rest-server	64.84%	🟢
lineage	53.02%	🟢
optimizer	83.24%	🟢
optimizer-api	21.95%	🔴
server	85.92%	🟢
server-common	76.12%	🟢
spark	28.57%	🔴
spark-common	46.01%	🟢
tencent	69.84%	🟢
transit	90.75%	🟢
trino-connector	40.29%	🟢

Files

Module	File	Coverage
api	KmsApi.java	100.0%	🟢
	KmsClient.java	100.0%	🟢
	KmsReference.java	100.0%	🟢
	KmsAuthenticationException.java	0.0%	🔴
	KmsClientFactory.java	0.0%	🔴
	KmsConfigurationException.java	0.0%	🔴
	KmsKeyProperties.java	0.0%	🔴
aws	AwsKmsClient.java	100.0%	🟢
	AwsKmsKeyProperties.java	100.0%	🟢
	AwsKmsClientFactory.java	93.33%	🟢
azure	AzureKeyVaultKmsKeyProperties.java	100.0%	🟢
	AzureKeyVaultKmsClientFactory.java	97.37%	🟢
	AzureKeyVaultKeyIdentifier.java	96.08%	🟢
	AzureKeyVaultKmsClient.java	88.89%	🟢
core	KmsConfig.java	100.0%	🟢
	KmsClientRegistry.java	98.88%	🟢
	GravitinoEnv.java	20.93%	🔴
gcp	GoogleCloudKmsKeyMetadata.java	100.0%	🟢
	GoogleCloudKmsKeyProperties.java	100.0%	🟢
	GoogleCloudKmsSdkMetadataService.java	100.0%	🟢
	GoogleCloudKmsClient.java	95.56%	🟢
	GoogleCloudKmsClientFactory.java	85.29%	🟢
	GoogleCloudKmsMetadataService.java	0.0%	🔴
transit	OpenBaoTransitKmsKeyProperties.java	100.0%	🟢
	TransitKeyData.java	100.0%	🟢
	TransitReadKeyResponse.java	100.0%	🟢
	VaultTransitKmsKeyProperties.java	100.0%	🟢
	OpenBaoTransitKmsClient.java	97.3%	🟢
	OpenBaoTransitKmsClientFactory.java	91.23%	🟢
	VaultTransitKmsClientFactory.java	91.23%	🟢
	TransitApiClient.java	90.22%	🟢
	TransitReadKeyRequest.java	83.33%	🟢
	VaultTransitKmsClient.java	82.35%	🟢
	FileTokenSupplier.java	81.48%	🟢

[nevzheng]

Moved to datastrato/gravitino-enterprise#907 under enterprise epic #899. Apache OSS scope remains #12132 and #12133 under #12131.