[FEATURE] 能否考虑增加一个网关之后路由之前的一个钩子

### Code of Conduct

- [x] I agree to follow this project's [Code of Conduct](https://www.apache.org/foundation/policies/conduct)

### Search before asking

- [x] I have searched in the [issues](https://github.com/apache/kyuubi/issues?q=is%3Aissue) and found no similar issues.

### Describe the feature

我想要在kyuubi网关中，添加一个用于在SQL路由到不同的执行引擎之前的一个钩子，其目的是可以由用户自行对其提交的SQL进行处理（例如鉴权，风险SQL拦截）等。我已知道目前可以对sparksql支持authz的一个鉴权，但是既然作为一个统一的大数据SQL网关，完全可以将这部分能力下方给用户，有了这个钩子，用户可以针对提交的sql做更多想做的事情。另外，是否还可以提供一个用于处理结果集的钩子，其目的是为了在返回的结果集中，可以对其结果集中的敏感数据进行加密，要知道现在很多企业中，仍然有很多明文信息，有了这个钩子，用户可以轻易的对其结果集进行二次处理。

### Motivation

_No response_

### Describe the solution

_No response_

### Additional context

_No response_

### Are you willing to submit PR?

- [ ] Yes. I would be willing to submit a PR with guidance from the Kyuubi community to improve.
- [ ] No. I cannot submit a PR at this time.

Start by tracing Kyuubi's gateway path from submitted SQL through routing to an execution engine, then identify how result sets return to users. Clarify the lifecycle, API contract, and security expectations for both pre-routing SQL hooks and result-set hooks; done means an agreed, implementable design with validation for authorization, risk-SQL blocking, and sensitive-data processing.

Written by the indexing model from the issue text.