[EPIC] Support authentication and authorization for Lance REST server

### Describe the subtask

Track authentication and authorization support for the Lance REST server.

Lance REST should reuse Gravitino authentication, request identity, active roles, authorization expressions, ownership, and audit semantics instead of introducing a separate permission model.

Authentication foundations already completed:

- [x] #11089 - Avoid duplicate Gravitino authentication in auxiliary mode (#11113)
- [x] #12255 - Authenticate standalone Lance REST service calls to Gravitino (#12256)

Remaining sub-issues:

- [x] #12557 - Preserve the authenticated caller identity (#12563)
- [x] #12591 - Extract a protocol-neutral metadata authorization pipeline
- [x] #12558 - Add the authorization framework and namespace read authorization
- [x] #12559 - Add namespace write authorization and ownership
- [x] #12560 - Add table read and list authorization
- [x] #12561 - Add table creation authorization and ownership
- [x] #12562 - Add table mutation and deletion authorization
- [ ] #12574 - Document Lance REST authentication and authorization

Implementation rules:

- Keep each issue functionally focused and independently testable.
- Keep each PR below 1000 changed lines, including tests and documentation.
- Include unit and integration tests in the same PR as the behavior they cover.
- Reuse Gravitino authorization expressions and deny precedence.
- Filter unauthorized list results before pagination and avoid leaking hidden metadata.
- Run ownership and audit operations as the authenticated caller.
- Keep behavior unchanged when authorization is disabled.

Metadata authorization is initially scoped to auxiliary mode, matching the Iceberg REST authorization model. Standalone per-user authorization requires a separate remote-authorization or policy-synchronization design and is out of scope. Credential vending is also out of scope.

### Parent issue

#8889