opa polaris authorizer: resolve authz inputs using scoped resolution; block unsupported operations

[gracechen09]

This is phase 6 of #3779.

Change 1: Resolve authz inputs using scoped resolution

Before the change, OPA authorizer called manifest.resolveAll(), which resolves the caller principal, all principal roles and all requested paths. OPA authorizer authorizes based on PolarisSecurable intent in AuthorizationRequest and doesn't use resolved principal or role entities.

After the change, resolveAuthorizationInputs() calls manifest.resolveSelections() with the input that OPA needs.

Change 2: Block unsupported operations

Before the change, authorize() handled all the operations.

After the change, authorize() blocks the operations that target the principal, principal_role and catalog_role entity types. When using OPA, principals and roles are expected to be managed externally, therefore OPA should not handle the authorization from Polaris principal management API.

Checklist

• 🛡️ Don't disclose security issues! (contact security@apache.org)
• 🔗 Clearly explained why the changes are needed, or linked related issues: Fixes #
• 🧪 Added/updated tests with good coverage, or manually tested (and explained how)
• 💡 Added comments for complex logic
• 🧾 Updated CHANGELOG.md (if needed)
• 📚 Updated documentation in site/content/in-dev/unreleased (if needed)