[Subtask] Forward the authenticated caller's credentials from standalone Lance REST to Gravitino

### Describe the subtask

Add a `caller` value for `gravitino.lance-rest.gravitino-auth-type` (and make it the default) under which each outbound Gravitino request carries the incoming caller's `Authorization` header and `X-Gravitino-Active-Roles`, read per request from the authenticated principal, with no service-account fallback.

Only `Basic` and `Bearer` are forwardable; `Negotiate` is rejected with 401 since a Kerberos ticket cannot be replayed to a second service. OAuth tokens must be valid at both services. `createNamespace` retries as a create when the preceding load is denied, so a caller holding only the create privilege is not blocked by the read.

Documentation must state the trust-boundary change: standalone Lance REST becomes a relay for caller credentials, and a compromised Lance REST process can act as any caller against Gravitino.

Implemented by #12984.

### Parent issue

#13090

Read parent issue #13090 and the implementation referenced by #12984 first, then inspect standalone Lance REST authentication and its outbound Gravitino requests. Done means caller credentials are forwarded under the default caller mode, Negotiate is rejected, createNamespace handles the denied-load retry, and the trust-boundary change is documented.

Written by the indexing model from the issue text.