[FEATURE REQUEST] Allow list permissions in vended credentials

### Is your feature request related to a problem? Please describe.

We are interested in using the vended credentials for Orphan File cleanup. However it seems that currently the provided vended credentials never allow listing.
I see the infrastructure supports passing PolarisStorageActions.LIST which would allow this, but no caller seems to pass this in from what I can tell.

### Describe the solution you'd like

Allow users to add a permission to the catalog role that enables file listing which will then ensure the vended credentials include the list operation permissions.

### Describe alternatives you've considered

_No response_

### Additional context

I believe spark also doesn't use the vended credentials at the moment and this might be the reason. Though I'm not sure if there is another reason for this.

Start by tracing how catalog-role permissions become vended credential operations, and find where PolarisStorageActions.LIST is supported but not passed by callers. Check whether Spark's use of vended credentials affects that path. Done means users can grant file-listing permission through a catalog role and the resulting credentials include the list operation.

Written by the indexing model from the issue text.