Enable PPL parse command on the analytics-engine route

Wire PPL `parse <field> '<regex>'` through PPL → Calcite → Substrait → DataFusion.
The command lowers to one `ITEM(PARSE(input, regex, "regex"), '<group>')` per named
group; PARSE returns `map<utf8, utf8>` of all named groups, ITEM extracts each
value. Both UDFs sit on the Rust side of the analytics backend.

Highlights:
* New Rust UDFs `parse` and `item` (`sandbox/plugins/analytics-backend-datafusion/
  rust/src/udf/{parse,item}.rs`). `parse` anchors the user pattern with `^(?:…)$`
  to honour Java's `Matcher.matches()` semantic that legacy `RegexExpression`
  relies on, so a row that doesn't match consumes nothing and every named group
  yields `""` — same observable behaviour as the legacy path.
* `ParseAdapter` validates the pattern + method operands as non-null string
  literals at plan time and gates the method to `regex` (rejects `grok` /
  `patterns` with a clear error pointing users at the legacy engine until those
  methods land).
* `FieldType.MAP`, `ScalarFunction.PARSE`, `ScalarFunction.ITEM`,
  `STANDARD_PROJECT_OPS` (ITEM is added; PARSE is registered separately for
  `FieldType.MAP` because no real OS mapping is a map and we don't want every
  scalar registering against the MAP bucket), `FunctionMappings.s` entries for
  `parse` and `item`, and YAML extension declarations.
* Codec MapVector handling at three sites (`ArrowValues`, `DatafusionResultStream`,
  `RowResponseCodec`) — `MapVector.getObject()` builds a `JsonStringHashMap`
  whose `<clinit>` references jackson-datatype-jsr310 not on the
  arrow-flight-rpc parent plugin's classloader, so each site reads the
  offset buffer + key/value sub-vectors directly.
* `session_context::create_session_context` now calls `udf::register_all`. The
  `executeWithContextAsync` fragment path was the only SessionContext creator
  that wasn't registering OpenSearch UDFs, so any analytics query through that
  path (the production fragment route) failed with "Unsupported function name".
  Pre-existing UDFs (`convert_tz`, `to_unixtime`) shared this gap silently
  because no IT exercised them through the same path.

`grok` and `patterns` parse methods are deliberately left on the legacy engine.
The Rust UDF rejects them with an explicit message; future onboardings will be
deliberate flips rather than silent semantics changes.

Verified end-to-end via `CalciteParseCommandIT` under
`tests.analytics.force_routing=true`: 7/7 passing (was 4/7 before — only the
testParseError* set passed, which throws at AST builder time before reaching
the analytics planner). The +3 delta covers `testParseCommand`,
`testParseCommandReplaceOriginalField`, and `testParseCommandWithOtherRunTimeFields`.

Sandbox QA `ParseCommandIT` (8/8) covers the same code paths against the
analytics path directly without depending on the SQL plugin worktree.

Signed-off-by: Jialiang Liang <jiallian@amazon.com>

Author: RyanL1997

sandbox/libs/analytics-framework/src/main/java/org/opensearch/analytics/spi/FieldType.java

@@ -56,6 +56,8 @@ public enum FieldType {
     OBJECT("object"),
     FLAT_OBJECT("flat_object"),
     COMPLETION("completion"),
+
+    // ── Composite ────────────────────────────────────────────────────
     /**
      * Array-typed expression result. Used for the return-type slot of array-producing scalar
      * functions (PPL {@code array(…)}, {@code array_slice}, {@code array_distinct}). Has no
@@ -64,7 +66,14 @@ public enum FieldType {
      * placeholder; {@link #fromMappingType} keeps working unchanged because no source
      * advertises that mapping string.
      */
-    ARRAY("array");
+    ARRAY("array"),
+    /**
+     * Models Calcite MAP return types for scalar functions such as PPL {@code parse}
+     * (parse → {@code map<varchar, varchar>} of named groups). No corresponding OpenSearch
+     * mapping type; {@link #fromMappingType} won't match {@code "map"} because no real OS
+     * mapping uses that name.
+     */
+    MAP("map");
 
     private final String mappingType;
 
@@ -127,6 +136,7 @@ public static FieldType fromSqlTypeName(SqlTypeName sqlTypeName) {
             case BOOLEAN -> FieldType.BOOLEAN;
             case BINARY, VARBINARY -> FieldType.BINARY;
             case ARRAY -> FieldType.ARRAY;
+            case MAP -> FieldType.MAP;
             default -> null;
         };
     }

sandbox/libs/analytics-framework/src/main/java/org/opensearch/analytics/spi/ScalarFunction.java

@@ -89,6 +89,15 @@ public enum ScalarFunction {
     NUMBER_TO_STRING(Category.STRING, SqlKind.OTHER_FUNCTION), // Alias for TOSTRING
     TONUMBER(Category.STRING, SqlKind.OTHER_FUNCTION),
     STRCMP(Category.STRING, SqlKind.OTHER_FUNCTION),
+    /**
+     * PPL {@code parse <field> '<regex>'} — extracts named regex groups into a
+     * {@code MAP<VARCHAR, VARCHAR>}. Resolves by identifier-name through
+     * {@link #fromSqlFunction(SqlFunction)} ({@code SqlKind.OTHER_FUNCTION}
+     * shared with many scalar UDFs). Pairs with {@link #ITEM} downstream:
+     * {@code parse} returns the map, {@code item(map, group)} extracts each
+     * named group at the call site.
+     */
+    PARSE(Category.STRING, SqlKind.OTHER_FUNCTION),
 
     // ── Cryptographic hash ─────────────────────────────────────────────
     // md5(x), sha1(x), sha2(x, bitLen) with bitLen ∈ {224,256,384,512}, crc32(x).

sandbox/plugins/analytics-backend-datafusion/rust/Cargo.toml

@@ -68,7 +68,7 @@ serde_json = { workspace = true, features = ["preserve_order"] }
 # multi-path JSON-array output. Moving to 1.x is a follow-up once we can
 # reproduce that distinction against the new API surface.
 jsonpath-rust = "=0.7.5"
-# mvfind UDF — regex matching against stringified array elements
+# mvfind / parse UDFs — regex matching
 regex = "=1.12.3"
 
 # Cryptographic hash UDFs. `sha1` is a dedicated crate (RFC 3174); DataFusion

sandbox/plugins/analytics-backend-datafusion/rust/src/session_context.rs

@@ -116,10 +116,11 @@ pub async unsafe fn create_session_context(
         .build();
 
     let ctx = SessionContext::new_with_state(state);
-    // Register OpenSearch UDFs (mvappend, mvfind, mvzip, convert_tz, …) on this session
-    // so the substrait converter at execute_with_context can resolve their function names.
-    // Without this, fragment execution fails with "Unsupported function name" because
-    // df_execute_with_context reuses this handle's ctx instead of building a fresh one.
+    // Register OpenSearch UDFs (parse, item, mvappend, mvfind, mvzip, convert_tz, …)
+    // on this session so the substrait converter at execute_with_context can resolve
+    // their function names. Without this, fragment execution fails with "Unsupported
+    // function name" because df_execute_with_context reuses this handle's ctx instead
+    // of building a fresh one.
     crate::udf::register_all(&ctx);
 
     // Register default ListingTable for parquet scans