RANGER-5666: update graalvm version to 25.1.3 - part 2

[ramackri]

Summary

Backfill the GraalJS 25.1.3 runtime JAR whitelist into 13 remaining plugin/server assembly descriptors so JavaScript policy conditions work on JDK 17+.

Part 1 (PR #1052) updated hdfs, hive, hbase, yarn, and solr. This PR covers:

Assembly	Whitelist output
knox-agent.xml	lib/ranger-knox-plugin-impl
storm-agent.xml	lib/ranger-storm-plugin-impl
plugin-kafka.xml	lib/ranger-kafka-plugin-impl
plugin-atlas.xml	lib/ranger-atlas-plugin-impl
plugin-elasticsearch.xml	lib/ranger-elasticsearch-plugin/ranger-elasticsearch-plugin-impl
plugin-kylin.xml	lib/ranger-kylin-plugin-impl
plugin-ozone.xml	lib/libext/ranger-ozone-plugin-impl
plugin-presto.xml	lib/ranger-presto-plugin-impl
plugin-sqoop.xml	lib/ranger-sqoop-plugin-impl
plugin-kms.xml	lib/ranger-kms-plugin-impl
plugin-trino.xml	lib
kms.xml	ews/webapp/WEB-INF/lib/ranger-kms-plugin-impl
pdp.xml	lib

Why

• RANGER-3970 added GraalJS to agents-common for JavaScript policy condition evaluation when Nashorn is unavailable (JDK 15+).
• RANGER-4076 / PR RANGER-4076: Support Java 17 for build and runtime #872 bumped graalvm.version and added GraalVM JAR includes to hdfs, hive, hbase, and yarn.
• RANGER-5603 / PR RANGER-5603: Docker setup updated to use Solr 9.4.1 #981 added the same block to plugin-solr.xml.
• RANGER-5666 / PR RANGER-5666: update graalvm version to 25.1.3 #1052 refreshed the 13-jar block for GraalVM 25.1.3 (js-language, etc.) in those five assemblies.

agents-common/pom.xml declares GraalJS dependencies, but most plugin tarballs are built with Maven Assembly explicit JAR whitelists (includeDependencies=true + <includes>). Transitive deps from ranger-plugins-common are not bundled unless listed.

Any plugin extending RangerBasePlugin that evaluates JS policy conditions on JDK 17+ needs GraalJS on the classpath at runtime. Reference: distro/src/main/assembly/hdfs-agent.xml.

GraalVM block added (per assembly)

<!-- GraalJS 25.x runtime (js is now a POM, not a JAR) -->
<include>org.graalvm.js:js-language:jar:${graalvm.version}</include>
<include>org.graalvm.js:js-scriptengine:jar:${graalvm.version}</include>
<include>org.graalvm.polyglot:polyglot:jar:${graalvm.version}</include>
<include>org.graalvm.regex:regex:jar:${graalvm.version}</include>
<include>org.graalvm.truffle:truffle-api:jar:${graalvm.version}</include>
<include>org.graalvm.truffle:truffle-runtime:jar:${graalvm.version}</include>
<include>org.graalvm.truffle:truffle-compiler:jar:${graalvm.version}</include>
<include>org.graalvm.sdk:jniutils:jar:${graalvm.version}</include>
<include>org.graalvm.sdk:collections:jar:${graalvm.version}</include>
<include>org.graalvm.sdk:nativeimage:jar:${graalvm.version}</include>
<include>org.graalvm.sdk:word:jar:${graalvm.version}</include>
<include>org.graalvm.shadowed:icu4j:jar:${graalvm.version}</include>
<include>org.graalvm.shadowed:xz:jar:${graalvm.version}</include>

Test plan

• mvn -pl agents-common test -Dtest=RangerRequestScriptEvaluatorTest
• mvn -f distro/pom.xml package -Pranger-kafka-plugin -DskipTests (assembly BUILD SUCCESS)
• CI build-17 full reactor verify
• Confirm Graal JARs in a built plugin tarball, e.g. tar tzf target/ranger-*-kafka-plugin.tar.gz | grep graalvm