[Bug report] Cloud credential-vending authorization ITs are stale after USE_SECRET gating

## Version

main branch

## Describe what's wrong

Apache #12983 intentionally requires `USE_SECRET` before `getCredentials` or
`getSecrets` returns plaintext credentials. The Cloud Filesystem Hadoop
authorization integration tests were not migrated with that policy change.

Those tests still expect credential vending when a caller has only
`READ_FILESET`, `WRITE_FILESET`, or fileset ownership. Under the new policy,
the server correctly returns an empty credential result unless the caller owns
the metalake or has scoped `USE_SECRET`.

This makes the Cloud credential-vending suite fail after the policy change.

## Error message and/or stacktrace

The Cloud Filesystem Hadoop job fails with six related failures:

- Three direct credential assertions expect one credential but receive zero.
- S3 read/write cases fail with `NoAwsCredentialsException`.
- The GCS read-only case unexpectedly writes because no vended credential is
installed and the test falls back to ambient GCP authentication.

## How to reproduce

1. Use Apache main containing #12983 / `25f874f`.
2. Run the cloud-enabled `:clients:filesystem-hadoop3:test` suite.
3. Exercise the fileset credential-vending authorization tests with only
`READ_FILESET`, `WRITE_FILESET`, or fileset ownership.

The credential endpoint returns an empty result because the caller lacks
`USE_SECRET`.

## Additional context

This is a test-migration omission, not a request to roll back the policy.

#12983 already added analogous `USE_SECRET` test grants for Spark JDBC in
`501f3cbf`, but did not update:

- `AbstractFileSystemCredentialAuthorizationIT`
- `FilesetCatalogAuthorizationCredentialIT`

Proposed repair:

- Grant and revoke fileset-scoped `USE_SECRET` alongside data privileges in
positive vending tests.
- Update the fileset-owner case to expect no credential until `USE_SECRET` is
granted.
- Add missing/denied-`USE_SECRET` coverage.
- Assert the GCS positive path received a vended token before asserting
read-only behavior.

Related to: https://github.com/apache/gravitino/pull/12983

Start with AbstractFileSystemCredentialAuthorizationIT and FilesetCatalogAuthorizationCredentialIT, then run :clients:filesystem-hadoop3:test on main containing #12983. Update the authorization cases using the proposed USE_SECRET grants and denials, and verify the GCS positive case receives a vended token before checking read-only behavior; all six related failures should pass.

Written by the indexing model from the issue text.