Derive additional credential scopes from the UC Delta credentials API

[foss-contributor]

🥞 Stacked PRs · foss-contributor/unitycatalog (fork-internal)

A 2-PR stack, both based on main. Review/merge bottom-up: #4 → #5.

Order	PR	Commits	Review just this PR's changes
1 — bottom	#4 — Derive additional credential scopes from the UC Delta credentials API ⬅ you are here	1	Files changed — 6 files
2 — top	#5 — Apply multi-location credential scopes in the Hadoop connector	2 (first commit is #4's)	Files changed — this PR only — 7 files

This PR is the base of the stack: 1 commit, and its Files changed is its own 6 files.

---

PR Checklist

• A description of the changes is added to the description of this PR.
• If there is a related issue, make sure it is linked to this PR.
• If you've fixed a bug or added code that should be tested, add tests!
• If you've added or modified a feature, documentation in docs is updated

Description of changes

Part 1 of 2 (splits the previous combined change). This is the producer half; PR 2 consumes it. No behavior change on its own.

A table's data can span storage locations beyond the table's own, and the UC Delta credentials API vends one credential per location. The connector kept only the credential covering the table's own location and dropped the rest, so reads of data under the other locations would fail.

This change captures the others:

• ScopedCredential — a vended credential bound to a location prefix.
• GenericCredentialFetcher.additionalScopedCredentials() — empty by default.
• UCDeltaGenericCredentialFetcher splits the Delta response into the primary plus the additional scopes.
• DeltaStorageCredentialUtil.toAdditionalScopedCredentials converts each non-primary cloud credential, skipping prefixes the connector can't translate (e.g. file://) and defaulting a missing operation to READ.

Tests: DeltaStorageCredentialUtilTest, UCDeltaGenericCredentialFetcherTest.