[FEATURE] Support login from a proxy user

### Code of Conduct

- [X] I agree to follow this project's [Code of Conduct](https://www.apache.org/foundation/policies/conduct)

### Search before asking

- [X] I have searched in the [issues](https://github.com/apache/kyuubi/issues?q=is%3Aissue) and found no similar issues.

### Describe the feature

As of now, kyuubi get subject like this.

```java
private Subject createSubject() {
if (isKeytabAuthMode()) {
String principal = sessConfMap.get(AUTH_KYUUBI_CLIENT_PRINCIPAL);
String keytab = sessConfMap.get(AUTH_KYUUBI_CLIENT_KEYTAB);
return KerberosAuthenticationManager.getKeytabAuthentication(principal, keytab).getSubject();
} else if (isFromSubjectAuthMode()) {
AccessControlContext context = AccessController.getContext();
return Subject.getSubject(context);
} else if (isTgtCacheAuthMode()) {
return KerberosAuthenticationManager.getTgtCacheAuthentication().getSubject();
} else {
// This should never happen
throw new IllegalArgumentException("Unsupported auth mode");
}
}
```
However when isFromSubjectAuthMode is true, it doesn't check if current subject has any credentials. We'd better double-check that if possible.

If current subject doesn't have any credentials, we'd better use left auth mode to get subject, such as TgtCacheAuthMode

### Motivation

_No response_

### Describe the solution

_No response_

### Additional context

Background: Our flink cluster create a login user using ticket cache, and create another proxy user based on that to run all user code.
So, in SubjectAuthMode, current user (actually a proxy user) doesn't have any credentials.

Here is how hadoop ipc.Client to handle sasl error,

### Are you willing to submit PR?

- [ ] Yes. I would be willing to submit a PR with guidance from the Kyuubi community to improve.
- [X] No. I cannot submit a PR at this time.

Start at the createSubject entry point shown in the issue and review how Subject credentials are checked in SubjectAuthMode. Compare the fallback behavior with Hadoop's ipc.Client SASL handling, then verify that a proxy user without credentials can use the remaining authentication mode, such as TgtCacheAuthMode.

Written by the indexing model from the issue text.