[Bug][AUTHZ] Iceberg metadata and changelog tables bypass privilege checks since 1.9.0

### Code of Conduct

- [X] I agree to follow this project's [Code of Conduct](https://www.apache.org/foundation/policies/conduct)

### Search before asking

- [X] I have searched in the [issues](https://github.com/apache/kyuubi/issues?q=is%3Aissue) and found no similar issues.

### Describe the bug

A user with no Ranger policy can read Iceberg metadata tables (`t.history`, `t.files`, `t.partitions`, ...) and `t.changes`, while `SELECT * FROM t` is denied. `t.files` and `t.changes` expose column values.

Reproduced on master (Spark 3.5.8, Iceberg 1.11.0) and on a production deployment (Kyuubi 1.12, Spark 4.1, Iceberg 1.11).

Cause: since #5248, `StringTableExtractor` handles only 1–3 dot-separated parts. These tables report a 4-part name (`cat.db.t.history`), the resulting `MatchError` is swallowed in `CommandSpec.tables`, and the scan is never checked. Before #5248 the query was denied on the odd resource `db.t/history` (#3924).

Related: #3924, #5803 (regression first noted in a comment), #4998 (duplicate).

### Affects Version(s)

1.9.0 – 1.12.x, master

### Kyuubi Server Log Output

_No response_

### Kyuubi Engine Log Output

_No response_

### Kyuubi Server Configurations

_No response_

### Kyuubi Engine Configurations

_No response_

### Additional context

Fix: authorize these tables as their data table (`BaseMetadataTable.table()`, `SparkChangelogTable.icebergTable`), as `VERSION AS OF` already is. Splitting the name is unsafe — `cat.a.b.c` is ambiguous with a nested namespace. PR ready.

### Are you willing to submit PR?

- [X] Yes. I can submit a PR independently to fix.
- [ ] Yes. I would be willing to submit a PR with guidance from the Kyuubi community to fix.
- [ ] No. I cannot submit a PR at this time.

Start at StringTableExtractor and CommandSpec.tables to trace the swallowed MatchError for four-part Iceberg names. Compare the existing VERSION AS OF authorization path with BaseMetadataTable.table() and SparkChangelogTable.icebergTable; done means metadata and changelog reads are authorized as the data table without treating nested namespaces as a split name.

Written by the indexing model from the issue text.