[FEATURE] Support Multi-Catalog Authorization with Multiple Ranger Services

[nqvuong1998]

Code of Conduct

• I agree to follow this project's Code of Conduct

Search before asking

• I have searched in the issues and found no similar issues.

Describe the feature

Support authorization for multiple Spark catalogs in Kyuubi Spark AuthZ, with each Spark catalog mapped to a different Apache Ranger service.
For example:

Spark Catalog        Ranger Service
------------------------------------
iceberg        ->     ranger_iceberg
paimon         ->     ranger_paimon
hive           ->     ranger_hive

Currently, Kyuubi Spark AuthZ does not provide a clear way to distinguish and authorize resources based on the Spark catalog and route authorization requests to different Ranger services.

Motivation

Spark supports multiple catalogs in the same Spark session, for example:

SELECT * FROM iceberg.sales.orders;
SELECT * FROM paimon.sales.orders;
SELECT * FROM hive.default.customers;

In a multi-catalog environment, different catalogs may represent different platforms, table formats, or security domains and may need independent Ranger policies.
Using a single Ranger service makes it difficult to isolate and manage authorization policies for each catalog.

Describe the solution

Add support for mapping Spark catalog names to Ranger services.
For example:

iceberg -> ranger_iceberg
paimon  -> ranger_paimon
hive    -> ranger_hive

When Kyuubi Spark AuthZ receives an authorization request for:

iceberg.sales.orders

it should:

catalog   = iceberg
namespace = sales
table     = orders

        ↓

Ranger service = ranger_iceberg

        ↓

Authorize sales.orders using ranger_iceberg

Similarly:

paimon.sales.orders

        ↓

Ranger service = ranger_paimon

        ↓

Authorize sales.orders using ranger_paimon

This would allow each Spark catalog to have its own Ranger service and independent authorization policies.

Additional context

This is useful for Spark deployments that use multiple catalogs, such as Iceberg, Paimon, Hive, or other catalogs configured in the same Spark/Kyuubi session.
The expected mapping is:

Spark Catalog → Ranger Service
Namespace     → Ranger Database
Table         → Ranger Table

This would allow Kyuubi Spark AuthZ to support multi-catalog authorization without requiring users to combine policies from all catalogs into a single Ranger service.

Are you willing to submit PR?

• Yes. I would be willing to submit a PR with guidance from the Kyuubi community to improve.
• No. I cannot submit a PR at this time.