Add per-resource permissions support to cluster_policies

[Sankalp-Mittal]

Summary

Stacked on #6225 (cluster policy resource). Adds the per-resource permissions field to cluster_policies so a policy can grant access via the direct engine's generic permissions applier.

Cluster policies support a single ACL level — CAN_USE (SDK compute.ClusterPolicyPermissionLevel), meaning "may create clusters governed by this policy." There is no CAN_MANAGE/CAN_VIEW/CAN_RUN; policy administration is an admin-only function.

resources:
  cluster_policies:
    my_policy:
      name: my-policy
      permissions:
        - level: CAN_USE
          group_name: users

Changes

• Resource wiring: declare ClusterPolicyPermission, add the Permissions field, register cluster_policies.permissions in the direct engine, and map the permissions-API object type to /cluster-policies/.
• FixPermissions: add cluster_policies to ignoredResources so the deploying user is not auto-injected as CAN_MANAGE/IS_OWNER — cluster policies can't accept it, and the real backend would reject the deploy (same treatment as secret_scopes).
• Testserver: model the real API — a non-CAN_USE level on a cluster policy returns 400, so local and cloud runs agree.
• Generated files: regenerated schema, refschema field list, and validation (level enum = CAN_USE only, level required).

Design note

cluster_policies is intentionally not added to the top-level levelsMap; it stays in unsupportedResources. The bundle-wide permissions: block is expressed in CAN_MANAGE/CAN_VIEW/CAN_RUN (and auto-grants the deployer CAN_MANAGE), none of which a cluster policy can accept. Supporting only the explicit per-resource form avoids silently dropping those grants. Two current-user injection paths had to be handled for this: the top-level levelsMap and the FixPermissions mutator.

Testing

Acceptance tests under acceptance/bundle/resources/cluster_policies/permissions/:

• basic/ — deploy applies the CAN_USE grants, redeploy updates the ACL; requests asserted with print_requests.py.
• out_of_band_change/ — an out-of-band ACL change is detected by bundle plan and reconciled on redeploy.
• levels/ (Cloud=true) — CAN_USE deploys successfully; a direct CAN_MANAGE set-permissions call is rejected (asserted with musterr; the backend error differs between the fake and cloud, so it is routed to a LOG file rather than pinned).

Plus the cluster_policies.permissions CRUD roundtrip fixture in dresources/all_test.go. Unit + acceptance suites pass locally.

This pull request and its description were written by Isaac.

[eng-dev-ecosystem-bot]

Integration test report

Commit: 504c16d

Run: 32132459409

	Env	🟨​KNOWN	🔄​flaky	💚​RECOVERED	🙈​SKIP	✅​pass	🙈​skip	Time
🟨​	aws linux	3		2	3	304	1438	11:55
🟨​	aws windows	3	1	2	3	305	1436	11:04
🟨​	azure linux	3		2	3	303	1438	9:37
🟨​	azure windows	3		2	3	305	1436	12:09
💚​	gcp linux			2	4	304	1438	8:28
💚​	gcp windows			2	4	306	1436	10:06

9 interesting tests: 3 SKIP, 3 KNOWN, 2 RECOVERED, 1 flaky

	Test Name	aws linux	aws windows	azure linux	azure windows	gcp linux	gcp windows
💚​	TestAccept	💚​R	💚​R	💚​R	💚​R	💚​R	💚​R
💚​	TestAccept/bundle/invariant/no_drift	💚​R	💚​R	💚​R	💚​R	💚​R	💚​R
🙈​	TestAccept/bundle/resources/vector_search_endpoints/drift/recreated_same_name	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S
🙈​	TestAccept/bundle/resources/vector_search_indexes/recreate/embedding_dimension	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S
🙈​	TestAccept/ssh/connection	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S	🙈​S
🔄​	TestSyncNestedFolderSync	✅​p	🔄​f	✅​p	✅​p	✅​p	✅​p
🟨​	TestFetchRepositoryInfoAPI_FromRepo	🟨​K	🟨​K	🟨​K	🟨​K	🙈​S	🙈​S
🟨​	TestFetchRepositoryInfoAPI_FromRepo/root	🟨​K	🟨​K	🟨​K	🟨​K
🟨​	TestFetchRepositoryInfoAPI_FromRepo/subdir	🟨​K	🟨​K	🟨​K	🟨​K

Top 8 slowest tests (at least 2 minutes):

duration	env	testname
7:10	gcp windows	TestAccept
5:32	azure windows	TestAccept
5:25	aws windows	TestAccept
3:54	azure linux	TestAccept
3:50	gcp linux	TestAccept
3:48	aws linux	TestAccept
2:37	azure windows	TestAccept/bundle/invariant/delete_idempotent/DATABRICKS_BUNDLE_ENGINE=direct/INPUT_CONFIG=cluster_policy.yml.tmpl/READPLAN=
2:21	azure windows	TestAccept/bundle/invariant/delete_idempotent/DATABRICKS_BUNDLE_ENGINE=direct/INPUT_CONFIG=cluster_policy.yml.tmpl/READPLAN=1

[github-actions]

Approval status: pending

/acceptance/bundle/ - needs approval

17 files changed
Suggested: @janniklasrose
Also eligible: @pietern, @denik, @andrewnester, @shreyas-goenka, @anton-107, @lennartkats-db

/bundle/ - needs approval

10 files changed
Suggested: @janniklasrose
Also eligible: @pietern, @denik, @andrewnester, @shreyas-goenka, @anton-107, @lennartkats-db

General files (require maintainer)

Files: libs/testserver/permissions.go
Based on git history:

• @janniklasrose -- recent work in bundle/internal/validation/generated/, bundle/schema/, bundle/direct/dresources/

_{Any maintainer (@andrewnester, @anton-107, @denik, @pietern, @shreyas-goenka, @simonfaltum, @renaudhartert-db, @janniklasrose, @lennartkats-db, @rugpanov, @rclarey) can approve all areas.
See OWNERS for ownership rules.}