[Bug] Hive query on Paimon table fails with 'Proxy user is not supported' when Kerberos proxy user is used

### Search before asking

- [x] I searched in the [issues](https://github.com/apache/paimon/issues) and found nothing similar.

### Paimon version

1.3.1

### Compute Engine

paimon-hive-connector-3.1, flink-1.17.1

### Minimal reproduce step

---
labels: bug, hive, kerberos
---

## Describe the bug

When a Paimon table is written through Flink and then queried from Hive via HiveServer2, the query fails with:

```
SELECT * FROM paimon_sink LIMIT 1;
Error: Error while compiling statement: FAILED: UnsupportedOperationException Proxy user is not supported (state=42000,code=40000)
```

## Environment

- Paimon version: 1.3.1
- Hive connector: `paimon-hive-connector-3.1`
- Hive access mode: HiveServer2 (JDBC / Beeline) with proxy user (`hive.server2.proxy.user=bdwh`)
- Kerberos: enabled

## Root cause analysis

The error is thrown from `org.apache.paimon.security.KerberosLoginProvider`:

```java
public void doLogin() throws IOException {
if (principal != null) {
LOG.info(
"Attempting to login to KDC using principal: {} keytab: {}", principal, keytab);
UserGroupInformation.loginUserFromKeytab(principal, keytab);
LOG.info("Successfully logged into KDC");
} else if (!isProxyUser(UserGroupInformation.getCurrentUser())) {
LOG.info("Attempting to load user's ticket cache");
UserGroupInformation.loginUserFromSubject(null);
LOG.info("Loaded user's ticket cache successfully");
} else {
throwProxyUserNotSupported();
}
}
```

The Kerberos login logic currently has three branches:

1. `principal` is non-null -> `UserGroupInformation.loginUserFromKeytab(principal, keytab)` (the Spark / Flink way).
2. `principal` is null and the current user is **not** a proxy user -> `UserGroupInformation.loginUserFromSubject(null)` (load the ticket cache).
3. `principal` is null and the current user **is** a proxy user -> throws `Proxy user is not supported`.

The problem is that Hive cannot log into Kerberos the same way Spark does — Hive does **not** support passing `--keytab` directly. Instead, an already-Kerberos-authenticated HiveServer2 acts as a proxy on behalf of the business user, with the caller specifying `hive.server2.proxy.user=bdwh` (e.g. via Beeline).

In this scenario, `principal` is null and the current UGI is a proxy user, so Paimon falls into branch 3 and throws `Proxy user is not supported`, which makes the whole query fail before it can even read the Paimon table.

## Proposed fix

For the proxy-user case, Paimon should do nothing (the Kerberos credentials are already provided by the HiveServer2 delegation / proxy mechanism) instead of throwing.

```java
public void doLogin() throws IOException {
if (principal != null) {
LOG.info(
"Attempting to login to KDC using principal: {} keytab: {}", principal, keytab);
UserGroupInformation.loginUserFromKeytab(principal, keytab);
LOG.info("Successfully logged into KDC");
} else if (!isProxyUser(UserGroupInformation.getCurrentUser())) {
LOG.info("Attempting to load user's ticket cache");
UserGroupInformation.loginUserFromSubject(null);
LOG.info("Loaded user's ticket cache successfully");
} else {
// Proxy user: do nothing, credentials are provided by HiveServer2 proxy.
// throwProxyUserNotSupported();
}
}
```

Note: an earlier attempt replaced the throw with `UserGroupInformation.loginUserFromSubject(null)`, but that can cause TGT issues; the final fix is to simply do nothing for proxy users.

## Verification

After applying the fix and rebuilding the Hive connector:

```bash
mvn -DskipTests -Dspotless.check.skip=true clean package -pl paimon-hive -am
# produces: paimon-hive-connector-3.1-1.3.1.jar
```

The query succeeds:

```
0: jdbc:hive2://dmc014011.venus.sohurdc.com:1> SELECT count(*) FROM paimon_sink LIMIT 1;
+---------+
| _c0 |
+---------+
| 154046 |
+---------+
1 row selected (75.586 seconds)
```

Ranger authorization also works as expected (the proxy user still needs the required privileges):

```
SELECT * FROM paimon_sink LIMIT 1;
Error: Error while compiling statement: FAILED: HiveAccessControlException Permission denied: user [bdwh] does not have [SELECT] privilege on [bdwh/paimon_sink/*] (state=42000,code=40000)
```

## Expected behavior

When Kerberos proxy user is used (as in HiveServer2), Paimon should not throw `Proxy user is not supported` and should allow queries to proceed.

## Additional context

Related code reference: `paimon-common/src/main/java/org/apache/paimon/security/KerberosLoginProvider.java`

### What doesn't meet your expectations?

FAILED: UnsupportedOperationException Proxy user is not supported

### Anything else?

_No response_

### Are you willing to submit a PR?

- [x] I'm willing to submit a PR!

Start with paimon-common/src/main/java/org/apache/paimon/security/KerberosLoginProvider.java and inspect doLogin(), especially the proxy-user branch and its existing UGI handling. Build the Hive connector with the provided Maven command, then verify that a HiveServer2 query using a Kerberos proxy user no longer fails with “Proxy user is not supported” while authorization still applies.

Written by the indexing model from the issue text.