Eliminate redundant metastore lookups when resolving principal roles

[ayushtkn]

DefaultAuthenticator.resolvePrincipalRoles runs on every authenticated request and already calls loadGrantsToGrantee, which returns both grant records and the resolved securable entities in a single bulk metastore read. The authenticator was ignoring those pre-loaded entities and calling loadEntity once per grant record, so a principal with N roles caused 1+N metastore reads per auth instead of one. This change resolves role names from LoadGrantsResult.getEntitiesAsMap(), matching the pattern already used in PolarisAdminService, while preserving existing behavior: missing entities and non-PRINCIPAL_ROLE securables are still filtered out, and requested-role filtering is unchanged.

Checklist

• 🛡️ Don't disclose security issues! (contact security@apache.org)
• 🔗 Clearly explained why the changes are needed, or linked related issues: Fixes #
• 🧪 Added/updated tests with good coverage, or manually tested (and explained how)
• 💡 Added comments for complex logic
• 🧾 Updated CHANGELOG.md (if needed)
• 📚 Updated documentation in site/content/in-dev/unreleased (if needed)

[Copilot]

Pull request overview

This PR optimizes DefaultAuthenticator.resolvePrincipalRoles to avoid per-grant metastore lookups by using the preloaded securable entities already returned from loadGrantsToGrantee, reducing authenticated-request overhead for principals with many role grants.

Changes:

• Resolve principal role names from LoadGrantsResult.getEntitiesAsMap() instead of calling loadEntity(...) for each grant record.
• Add a Quarkus test to ensure role resolution does not trigger per-grant loadEntity(..., PRINCIPAL_ROLE) calls.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
runtime/service/src/main/java/org/apache/polaris/service/auth/DefaultAuthenticator.java	Switches role-entity resolution to use the preloaded entities map from LoadGrantsResult to eliminate redundant metastore calls.
runtime/service/src/test/java/org/apache/polaris/service/auth/DefaultAuthenticatorTest.java	Adds a regression test that verifies role resolution does not perform per-grant role entity loads.

[dimas-b]

Nice optimization, @ayushtkn ! Changes LGTM, but let's also get a review from @adutra (probably next week).