feat(model): add unified system entity data access control

[david-leifker]

Summary

• Add @SystemEntity / @System PDL annotations and the dataHubSystemState production entity for GMS-internal operational state
• Enforce system data access at three layers: AuthUtil API gate (403), DAO read filter (SystemDataReadFilter + AspectReadGuard), and write validator (SystemDataWriteValidator / SYSTEM_ACTOR only)
• Centralize enable/disable via authorization.systemDataAccessControl.enabled (SystemDataAccessControlConfiguration) wired into AuthUtil and plugin registration

Test plan

• :entity-registry:test — policy, read filter, write validator, annotation parsing
• :metadata-auth:auth-api:test — AuthUtil system-data gate
• :metadata-io:test — AspectReadGuard, DAO batchGet/getLatestAspects, Cassandra + Ebean paths
• :metadata-service:factories:test — Spring plugin wiring
• smoke-test/tests/system_data/test_system_data_access.py — live GMS against dataHubSystemState

Made with Cursor

[codecov]

Codecov Report

❌ Patch coverage is 81.38298% with 105 lines in your changes missing coverage. Please review.
✅ All tests successful. No failed tests found.

Files with missing lines	Patch %	Lines
...nkedin/metadata/aspect/filter/AspectReadGuard.java	75.51%	10 Missing and 2 partials ⚠️
...om/linkedin/metadata/models/EntitySpecBuilder.java	72.97%	10 Missing ⚠️
.../main/java/com/datahub/authorization/AuthUtil.java	77.27%	5 Missing and 5 partials ⚠️
...tadata/aspect/plugins/filter/AspectReadFilter.java	11.11%	7 Missing and 1 partial ⚠️
...inkedin/metadata/aspect/plugins/PluginFactory.java	70.83%	5 Missing and 2 partials ⚠️
...ata/aspect/plugins/config/PluginConfiguration.java	50.00%	6 Missing and 1 partial ⚠️
...om/linkedin/metadata/models/PartialEntitySpec.java	0.00%	7 Missing ⚠️
...inkedin/metadata/policy/SystemDataPolicyIndex.java	88.70%	3 Missing and 4 partials ⚠️
.../metadata/entity/cassandra/CassandraAspectDao.java	88.70%	4 Missing and 3 partials ⚠️
...tadata/models/annotation/SystemDataVisibility.java	76.47%	3 Missing and 1 partial ⚠️
... and 10 more

📢 Thoughts on this report? Let us know!