[security] Make SASL mechanisms extensible

[litiliu]

Purpose

Related issue: #3495

This PR prepares the Fluss RPC SASL authentication layer for adding built-in mechanisms such as OAUTHBEARER. The existing implementation constructs PLAIN authenticators directly, which makes adding another mechanism require changing the PLAIN implementation path.

This is intentionally a foundation-only change. It does not add OAuth token acquisition, JWT validation, JWKS handling, group principals, or ACL changes.

Brief change log

• Add a stateless SaslAuthenticatorFactory that selects a built-in SASL mechanism and creates one connection-local authenticator.
• Extract the existing PLAIN server implementation into PlainSaslServerAuthenticator.
• Keep SaslServerAuthenticator as the connection-local dispatcher that validates the requested server mechanism and delegates authentication.
• Preserve the existing PLAIN configuration, JAAS fallback, RPC handshake, and authentication behavior.
• Reject an unsupported client mechanism when the client authenticator is created instead of during connection initialization.
• Add focused coverage for mechanism selection, case normalization, independent authenticator instances, and unsupported mechanisms.

Tests

• ./mvnw -pl fluss-common -DskipITs -Dtest=SaslAuthenticatorFactoryTest,PlainSaslServerTest clean test
  • 7 tests passed.
  • Checkstyle and Spotless passed.
• git diff --check

API and Format

No public API, RPC wire format, or storage format changes.

The new factory is internal. No new configuration options are introduced.

Documentation

No documentation changes are required because this PR does not expose a new authentication mechanism or configuration.

[litiliu]

@loserwang1024 hongshun, PTAL