[Bug] Authz rule inject place too early causing some plan not fully optimized

### Code of Conduct

- [X] I agree to follow this project's [Code of Conduct](https://www.apache.org/foundation/policies/conduct)

### Search before asking

- [X] I have searched in the [issues](https://github.com/apache/kyuubi/issues?q=is%3Aissue) and found no similar issues.

### Describe the bug

Authz rule inject place too early causing some plan not fully optimized

### Affects Version(s)

master

### Kyuubi Server Log Output

_No response_

### Kyuubi Engine Log Output

_No response_

### Kyuubi Server Configurations

_No response_

### Kyuubi Engine Configurations

_No response_

### Additional context

_No response_

### Are you willing to submit PR?

- [ ] Yes. I would be willing to submit a PR with guidance from the Kyuubi community to fix.
- [ ] No. I cannot submit a PR at this time.

No source file, test, or reproducible plan is named. Start by locating the Scala authorization-rule injection and query-plan optimization paths, then reproduce a plan that remains partially unoptimized. Done means authorization is applied at the correct point and the affected plan is fully optimized, with a regression test if the relevant test location can be identified.

Written by the indexing model from the issue text.