Metastore-level ABAC policies

Lets admins attach an ABAC policy (row filter, column mask, GRANT or DENY) to the whole metastore, so one policy covers every catalog, including catalogs created later. Governance teams get one place for organization-wide rules instead of copying a policy into each catalog.

Status and dates are extracted from public sources only. We don't see the private AE-shared roadmap. If something looks wrong, tell us.