feat(security): add OIDC provider DDL with catalog persistence

Introduces CREATE, ALTER, DROP, and SHOW OIDC PROVIDER statements
end-to-end:

- SQL parser: OidcClaimMappingClause AST node; new oidc_provider
  parse module handles CREATE/ALTER/DROP/SHOW OIDC PROVIDER syntax
  including CLAIM MAPPING WHEN clauses with DEFAULT_DATABASE, ADD
  DATABASES, and ADD ROLES sub-clauses.
- Catalog: _system.oidc_providers redb table storing StoredOidcProvider
  (issuer, jwks_uri, audience, ordered claim-mapping rules, lsn).
  put/get/list/delete ops on SystemCatalog.
- CatalogEntry: PutOidcProvider and DeleteOidcProvider variants wired
  through apply, descriptor_stamp, gateway_invalidation (no-op),
  post-apply sync, async dispatcher, and cluster metadata audit.
- DDL handlers: pgwire/ddl/oidc/ (create, alter, drop, show) enforce
  superuser/ClusterAdmin privilege gates, write the catalog entry, and
  emit OidcProviderChanged audit events.
- DatabaseDescriptor gains idle_session_timeout_secs field (default 0)
  used later by ALTER DATABASE SET IDLE_TIMEOUT.

Author: farhan-syah

nodedb-sql/src/ddl_ast/mod.rs

@@ -27,4 +27,7 @@ pub use graph_types::{GraphDirection, GraphProperties};
 pub use nodedb_types::QuotaSpec;
 pub use nodedb_types::{MirrorMode, MirrorStatus};
 pub use parse::parse;
-pub use statement::{AlterDatabaseOperation, AlterTenantOperation, CloneAsOf, NodedbStatement};
+pub use statement::{
+    AlterDatabaseOperation, AlterTenantOperation, CloneAsOf, NodedbStatement,
+    OidcClaimMappingClause,
+};

nodedb-sql/src/ddl_ast/parse/dispatch.rs

@@ -4,8 +4,8 @@
 
 use super::{
     alert, backup, change_stream, cluster_admin, collection, conflict_policy, copy_from, copy_to,
-    custom_type, database, index, maintenance, materialized_view, retention, rls, schedule,
-    sequence, synonym_group, tenant, trigger, user_auth,
+    custom_type, database, index, maintenance, materialized_view, oidc_provider, retention, rls,
+    schedule, sequence, synonym_group, tenant, trigger, user_auth,
 };
 use crate::ddl_ast::graph_parse;
 use crate::ddl_ast::statement::NodedbStatement;
@@ -77,6 +77,7 @@ pub fn parse(sql: &str) -> Option<Result<NodedbStatement, SqlError>> {
     // COPY TO file-path form — table and query forms.
     try_family!(copy_to::try_parse(&upper, trimmed));
     try_family!(user_auth::try_parse(&upper, &parts, trimmed));
+    try_family!(oidc_provider::try_parse(&upper, &parts, trimmed));
     try_family!(change_stream::try_parse(&upper, &parts, trimmed));
     try_family!(rls::try_parse(&upper, &parts, trimmed));
     try_family!(materialized_view::try_parse(&upper, &parts, trimmed));

nodedb-sql/src/ddl_ast/parse/mod.rs

@@ -15,6 +15,7 @@ mod helpers;
 mod index;
 mod maintenance;
 mod materialized_view;
+mod oidc_provider;
 mod retention;
 mod rls;
 mod schedule;