[#12344] improvement(core): add OCC for roles

[yuqi1129]

What changes were proposed in this pull request?

Make managed role mutations concurrency-safe with database OCC and one transaction per service operation.

• Fence the active parent metalake by expected version before creating a role.
• Insert the root role before its securable objects, in the same transaction as the parent fence.
• Always advance the role OCC version on alter, including metadata-only changes with no securable-object delta.
• Update and delete the root role by id plus expected version before changing authorization relationships.
• Roll back the complete operation and throw OptimisticLockException when a CAS fails.

This PR depends on #12350, which provides the metalake OCC fence.

Why are the changes needed?

Concurrent managed-role operations must not create roles under a concurrently deleted metalake, overwrite newer role metadata, or partially commit securable-object and authorization relationship changes.

Fix: #12344

Does this PR introduce any user-facing change?

Concurrent managed role mutations fail atomically and report HTTP 409 through the shared optimistic-lock conflict contract.

How was this patch tested?

Added tests for parent fencing and rollback, metadata-only OCC updates, stale alter/delete conflicts, and securable-object rollback. Ran:

./gradlew :core:test --tests 'org.apache.gravitino.storage.relational.service.TestRoleMetaService' -PskipITs

[github-actions]

Code Coverage Report

Overall Project	68.13% +0.28%	🟢
Files changed	89.14%	🟢

Module	Coverage
aliyun	1.72%	🔴
api	49.28%	🟢
authorization-common	85.96%	🟢
aws	42.04%	🟢
azure	2.47%	🔴
catalog-common	9.92%	🔴
catalog-fileset	79.74%	🟢
catalog-glue	66.91%	🟢
catalog-hive	79.4%	🟢
catalog-jdbc-common	45.7%	🟢
catalog-jdbc-doris	81.8%	🟢
catalog-jdbc-mysql	79.33%	🟢
catalog-jdbc-postgresql	83.39%	🟢
catalog-jdbc-starrocks	79.16%	🟢
catalog-kafka	77.01%	🟢
catalog-lakehouse-generic	59.18%	🟢
catalog-lakehouse-hudi	79.1%	🟢
catalog-lakehouse-iceberg	85.86%	🟢
catalog-lakehouse-paimon	84.23%	🟢
catalog-model	77.72%	🟢
cli	44.49%	🟢
client-java	78.27%	🟢
common	52.11%	🟢
core	83.06% +0.27%	🟢
filesystem-hadoop3	77.28%	🟢
flink	0.0%	🔴
flink-common	48.68%	🟢
flink-runtime	0.0%	🔴
gcp	14.12%	🔴
hadoop-auth	68.0%	🟢
hadoop-common	12.7%	🔴
hive-metastore-common	53.4%	🟢
iceberg-common	64.75%	🟢
iceberg-rest-server	75.03%	🟢
idp-basic	86.02%	🟢
integration-test-common	0.0%	🔴
jobs	66.17%	🟢
lance-common	24.5%	🔴
lance-rest-server	64.23%	🟢
lineage	53.02%	🟢
optimizer	83.17%	🟢
optimizer-api	21.95%	🔴
server	85.76%	🟢
server-common	76.45%	🟢
spark	28.57%	🔴
spark-common	45.89%	🟢
tencent	69.84%	🟢
trino-connector	40.29%	🟢

Files

Module	File	Coverage
core	RoleMetaBaseSQLProvider.java	100.0%	🟢
	RoleMetaPostgreSQLProvider.java	100.0%	🟢
	RoleMetaSQLProviderFactory.java	96.0%	🟢
	RoleMetaService.java	92.8%	🟢
	POConverters.java	88.25%	🟢
	RoleMetaMapper.java	0.0%	🔴