KNOX-3397: Add preauth.auth.header.actor.groups to set actor groups header name explicitly

[smolnar82]

KNOX-3397 - Allow the actor groups header name to be configured explicitly

What changes were proposed in this pull request?

KNOX-3354 removed the index suffix from the actor groups header when roles are resolved at the resource layer (rather than in the LDAP interceptors), so that the configured actor groups header is not postfixed. This is useful in environments where role lookup is configured locally.

However, a topology may instead use the RemoteAuthFilter to authenticate requests, where the remote counterpart is configured for role lookup. In that case remote.auth.group.header returns roles rather than groups, but the KNOX-AUTH-SERVICE configured in the topology still emits the suffixed version of preauth.auth.header.actor.groups.prefix, causing a mismatch.

To give operators explicit control over this, this PR introduces a new configuration parameter in AbstractAuthResource: preauth.auth.header.actor.groups. When declared, it takes precedence over the existing preauth.auth.header.actor.groups.prefix parameter and is used directly as the groups header name in the response, without any index suffix.

When the new parameter is not set, behavior is unchanged (fully backward compatible). The header-name selection logic was also extracted into a small private createGroupsHeaderName(...) helper for readability.

How was this patch tested?

• Added a unit test (PreAuthResourceTest#testExplicitGroupsHeaderTakesPrecedenceOverPrefix) that configures both the explicit header and a prefix, and verifies the explicit header is emitted directly, exactly once, with no index suffix.
• Ran the full PreAuthResourceTest suite: Tests run: 9, Failures: 0, Errors: 0, Skipped: 0.

Integration Tests

N/A

UI changes

N/A

[github-actions]

Test Results

40 tests   40 ✅  6s ⏱️
 3 suites   0 💤
 3 files     0 ❌

Results for commit 418d53b.