feat(iceberg): add AWS Glue Data Catalog + S3 Tables catalog modes

[aaj3f]

Summary

Adds two native-AWS-SDK catalog modes to the Iceberg/R2RML graph-source path — AWS Glue Data Catalog (--mode glue) and AWS S3 Tables (--mode s3tables) — at full parity with the existing REST (Polaris / Snowflake Horizon) and Direct modes.

fluree iceberg map gs --mode glue     --table enterprise_dw.dim_store --region us-east-1 --r2rml m.ttl
fluree iceberg map gs --mode s3tables --table ns.tbl --table-bucket-arn arn:aws:s3tables:... --region us-east-1 --r2rml m.ttl

Approach

Both modes resolve the table's metadata_location through the native AWS SDK (aws-sdk-glue GetTable / aws-sdk-s3tables GetTableMetadataLocation), then read metadata/manifests/data from S3 with the ambient credential chain — reusing the existing direct.rs reader and from_default_chain. No aws-sigv4, no request signing, no REST prefix, no vended-credential parsing.

Why SDK-native rather than REST + SigV4: empirically, for a normally S3-authorized principal, neither Glue DC (IAM mode) nor S3 Tables vends credentials, so ambient reads suffice — and staying on the AWS SDK keeps consistent signing/transport paths (prefer the SDK / override its HTTP client via aws-smithy-http rather than roll alternatives) instead of a hand-rolled REST+SigV4 client.

Changes

Commit 1 — core: GlueSdkCatalogClient + S3TablesSdkCatalogClient (catalog/aws_sdk.rs); CatalogConfig::Glue/S3Tables (serde "glue"/"s3tables", variant ungated / SDK impl aws-gated); two r2rml.rs scan arms; CatalogMode + CLI + server map; aws-sdk-glue/aws-sdk-s3tables deps; read_glue example + offline tests.

Commit 2 — full parity:

• Onboarding/introspection (catalog browse, table preview, R2RML auto-generate, mapping validate) — were hard-rejected for glue/s3tables, now work. rest_catalog_client → catalog_client returns a boxed SendCatalogClient per mode; preview fetches+parses table metadata from S3 via metadata_location when the catalog returns no inline metadata (the SDK loadTable does); server IcebergConnectionRequest/build_iceberg_connection widened. generate/validate unblock transitively (they call preview per table).
• Query-time (correctness + perf): glue/s3tables scans now use the same per-query snapshot pin + cross-query loadTable cache as REST (sdk_resolve_load_table), so every scan in a query reads one pinned Iceberg snapshot, and the SDK client is built only on a cache miss.

Validation

• Offline: config + iceberg_catalog + server-route + api-lib (689) + iceberg (192) suites pass; fmt/clippy clean.
• Live (Glue + S3 Tables harness in a sandbox): read_glue example reads exact row counts (Glue 500 / 60,000, S3 Tables 200). SPARQL e2e over Glue returns exact Athena-oracle values — 300 stores, 60,000 order-line⋈product, 6 categories, 20,000 order⋈customer — incl. multi-table joins, and a dangling-FK row confirms the R2RML inner join drops it (60,001 total / 60,000 joined). browse + preview validated live against Glue (fluree-db-api/examples/glue_onboarding.rs).

Follow-ups (out of scope here)

• Lake-Formation-governed Glue where a restricted principal needs vended credentials (the existing Snowflake vended-cred code has the mechanics).
• Latent bug: vended-cred parsing reads only the legacy top-level config map, not the standardized storage-credentials array that S3 Tables / LF-vended Glue return (would silently fall to ambient and 403). Not hit by this PR (ambient by design).