Reconcile Role resources with a non-superuser admin such as the master user of managed PostgreSQL cloud services

[ThoSap]

Fixes #70

The Role controller failed on AWS RDS with permission denied for table pg_authid.
The same happens on every managed PostgreSQL service and on any vanilla PostgreSQL where the admin/management user is usually not a superuser, not do the cloud offerings support crating a superuser.
This PR makes the Role controller work with an admin role that has only LOGIN, CREATEDB, and CREATEROLE.

What changed

1. Reads use pg_roles instead of pg_authid. Role state and membership come from the public view pg_roles and the public catalog pg_auth_members. pg_authid stays in the generated jOOQ sources for the test helper only.
2. ALTER ROLE names only the options that differ from the current state. PostgreSQL rejects NOSUPERUSER, NOREPLICATION, and NOBYPASSRLS from a non-superuser even when the value does not change, so the previous full statement failed on every update of an existing role.
3. The password hash comparison is replaced by a keyed fingerprint. The hash in pg_authid cannot be read without superuser rights. The operator now stores an HMAC-SHA256 of the Secret password in status.passwordFingerprint and compares against it on each reconcile. The key is random and lives in a Secret in the operator namespace (postgresql-operator.password-fingerprint.secret-name). A reader of the Role status learns nothing about the password without that key. The RBAC rule for secrets gains create for this one Secret.
4. The operator sends a SCRAM-SHA-256 verifier instead of the cleartext password. The cleartext never reaches the server or its statement log. A Secret that already holds a verifier passes through unchanged. The new spec field passwordEncryption: server opts out for MD5-only clients. CloudNativePG does the same since v1.29.2.
5. New test RoleReconcilerNonSuperuserTest runs the controller with a LOGIN CREATEDB CREATEROLE admin. It covers create, update, password rotation, login toggle, membership, drop, and the error path for superuser: true.

Documented consequences

• Minimum admin privileges per Custom Resource, see docs/cluster-connection.md.
• A non-superuser admin cannot set superuser, replication, or bypassrls.
• On PostgreSQL 16+, the admin can only alter roles on which it holds ADMIN OPTION.
• A password change made directly in PostgreSQL is not detected. The Secret is the source of truth.
• Every existing Role gets one password update after the upgrade, because its status has no fingerprint yet.
• A pre-hashed password bypasses server-side password policies such as credcheck or the Cloud SQL password policy.

Verification against a non-superuser admin

Run on PostgreSQL 15 and 18 as LOGIN NOSUPERUSER CREATEDB CREATEROLE, which mirrors the master user of the managed services.

Check	PG 15	PG 18
SELECT on pg_authid	denied, 42501	denied, 42501
SELECT on pg_shadow	denied, 42501	denied, 42501
SELECT on pg_roles, all flag columns	ok, password masked	ok, password masked
SELECT on pg_auth_members	ok	ok
shobj_description(oid, 'pg_authid') with the oid from pg_roles	ok	ok
Previous buildAlterRole statement	denied, 42501	denied, 42501
ALTER ROLE ... NOSUPERUSER / NOREPLICATION / NOBYPASSRLS alone	denied	denied
ALTER ROLE with login, password, createdb, createrole, inherit, connection limit, valid until	ok	ok
GRANT / REVOKE membership on a role the admin created	ok	ok
ALTER ROLE ... PASSWORD '<SCRAM verifier>'	stored verbatim, login works	stored verbatim, login works

Managed PostgreSQL offerings

Offering	Admin role	pg_authid
AWS RDS for PostgreSQL, Amazon Aurora	rds_superuser	denied
Google Cloud SQL, AlloyDB	cloudsqlsuperuser, alloydbsuperuser	denied by default, flag cloudsql.pg_authid_select_role can grant it
Azure Database for PostgreSQL Flexible Server	azure_pg_admin	denied
Neon	neon_superuser	denied for all but the project owner
Supabase	postgres	denied since the 2023 demotion
Aiven, DigitalOcean, Heroku, Timescale Cloud, Scaleway, OVH, IBM Cloud	provider admin role	denied
Crunchy Bridge, self-hosted, CloudNativePG, Zalando, Crunchy PGO, StackGres, Percona	postgres	readable, real superuser

The change works on all of them, because it uses only public catalogs and never names superuser-only options without a change.

Tests

• All Role tests pass on PostgreSQL 18, 24 tests.
• The full suite passes except the Helm install test, which fails locally on Helm 4 with the known server-side apply conflict. CI runs Helm 3.
• The compile is clean under the ErrorProne and javac -Xlint settings of Replace Checkstyle with Error Prone #66 and Enable the javac -Xlint categories that Error Prone cannot see #67.