Support Thrift over HTTP for HMS

Support Thrift over HTTP

Description

Some customers struggle to expose plain TCP to the outside of k8s world.
Also Kerberos is pain in the ***, and there is currently no other auth mechanism for HMS.

We should support Thrift over HTTP to solve both problems.

1. HTTP can easily be exposed (such as all other HTTP services, e.g. via an Ingress)
2. Users can put a basic auth / oAuth proxy / ... in front of the HTTP service

Value

Users can expose and secure stuff without Kerberos

Dependencies

None

Tasks

Acceptance Criteria

• HTTP disabled by default
• HTTP can be turned on while turning TCP off
• HTTP and TCP can be turned on at the same time (seems to be supported starting with 4.0.0 https://issues.apache.org/jira/browse/HIVE-5312)

(Information Security) Risk Assessment

This gives the option to switch from a (IMHO hard to protect - Kerberos) TCP protocol to the HTTP protocol.
This probably means Kerberos will stop working, but users can put some sort of LoadBalancer/Proxy in front to do the authentication instead of messing with Kerberos.

Accessibility Assessment

None

Quality

Tests with Spark and Trino

Release Notes

Support HTTP thrift transport mode for Hive metastore

No files or test paths are named; start by locating the Hive Metastore transport configuration and deployment entry points in this Rust operator, then review the Spark and Trino integration tests. Done means HTTP is disabled by default, can run instead of TCP or alongside it, and the behavior is verified with Spark and Trino.