[#12343] improvement(core): add OCC for users and groups

[yuqi1129]

What changes were proposed in this pull request?

Make managed user and group mutations concurrency-safe with database OCC and one transaction per service operation.

• Fence the active parent metalake by expected version before creating a user or group.
• Insert the root entity and role relationships in the same transaction as the parent fence.
• Always advance the root OCC version on alter, including metadata-only changes with no role delta.
• Apply the same expected-version CAS to user external-id/by-id operations and the latest group by-id operations.
• Update and delete the root row before changing role or owner relationships.
• Roll back the complete operation and throw OptimisticLockException when a CAS fails.

This PR depends on #12350, which provides the metalake OCC fence.

Why are the changes needed?

Concurrent managed-principal operations must not create children under a concurrently deleted metalake, overwrite newer metadata, or commit only part of a multi-row service operation.

Fix: #12343

Does this PR introduce any user-facing change?

Concurrent managed user and group mutations fail atomically and report HTTP 409 through the shared optimistic-lock conflict contract.

How was this patch tested?

Added tests for parent fencing and rollback, metadata-only and by-id OCC updates, stale alter/delete conflicts, external-id updates, and relationship rollback. Ran:

./gradlew :core:test --tests 'org.apache.gravitino.storage.relational.service.TestUserMetaService' --tests 'org.apache.gravitino.storage.relational.service.TestGroupMetaService' -PskipITs

[github-actions]

Code Coverage Report

Overall Project	68.15% +0.34%	🟢
Files changed	90.67%	🟢

Module	Coverage
aliyun	1.72%	🔴
api	49.28%	🟢
authorization-common	85.96%	🟢
aws	42.04%	🟢
azure	2.47%	🔴
catalog-common	9.92%	🔴
catalog-fileset	79.74%	🟢
catalog-glue	66.91%	🟢
catalog-hive	79.4%	🟢
catalog-jdbc-common	45.7%	🟢
catalog-jdbc-doris	81.8%	🟢
catalog-jdbc-mysql	79.33%	🟢
catalog-jdbc-postgresql	83.39%	🟢
catalog-jdbc-starrocks	79.16%	🟢
catalog-kafka	77.01%	🟢
catalog-lakehouse-generic	59.18%	🟢
catalog-lakehouse-hudi	79.1%	🟢
catalog-lakehouse-iceberg	85.86%	🟢
catalog-lakehouse-paimon	84.23%	🟢
catalog-model	77.72%	🟢
cli	44.49%	🟢
client-java	78.27%	🟢
common	52.11%	🟢
core	83.09% +0.38%	🟢
filesystem-hadoop3	77.28%	🟢
flink	0.0%	🔴
flink-common	48.68%	🟢
flink-runtime	0.0%	🔴
gcp	14.12%	🔴
hadoop-auth	68.0%	🟢
hadoop-common	12.7%	🔴
hive-metastore-common	53.4%	🟢
iceberg-common	64.75%	🟢
iceberg-rest-server	75.1%	🟢
idp-basic	86.02%	🟢
integration-test-common	0.0%	🔴
jobs	66.17%	🟢
lance-common	24.5%	🔴
lance-rest-server	64.23%	🟢
lineage	53.02%	🟢
optimizer	83.24%	🟢
optimizer-api	21.95%	🔴
server	85.76%	🟢
server-common	76.45%	🟢
spark	28.57%	🔴
spark-common	45.89%	🟢
tencent	69.84%	🟢
trino-connector	40.29%	🟢

Files

Module	File	Coverage
core	GroupMetaBaseSQLProvider.java	100.0%	🟢
	UserMetaBaseSQLProvider.java	100.0%	🟢
	GroupMetaPostgreSQLProvider.java	100.0%	🟢
	UserMetaPostgreSQLProvider.java	100.0%	🟢
	GroupMetaService.java	98.84%	🟢
	UserMetaService.java	98.31%	🟢
	UserMetaSQLProviderFactory.java	96.3%	🟢
	GroupMetaSQLProviderFactory.java	96.0%	🟢
	POConverters.java	88.25%	🟢
	GroupMetaMapper.java	0.0%	🔴
	UserMetaMapper.java	0.0%	🔴