[branch-4.1][fix](security) Add auth and config gate for _stream_load_forward endpoint

[liaoxin01]

Pick #64935

[hello-stephen]

Thank you for your contribution to Apache Doris.
Don't know what should be done next? See How to process your PR.

Please clearly describe your PR:

1. What problem was fixed (it's best to include specific error reporting information). How it was fixed.
2. Which behaviors were modified. What was the previous behavior, what is it now, why was it modified, and what possible impacts might there be.
3. What features were added. Why was this function added?
4. Which code was refactored and why was this part of the code refactored?
5. Which functions were optimized and what is the difference before and after the optimization?

[Copilot]

Pull request overview

This PR backports a security fix to the BE _stream_load_forward endpoint by adding an explicit BE-side config gate and wiring the endpoint into the existing HTTP auth framework, aligning it with cloud group-commit forwarding behavior.

Changes:

• Gate /api/{db}/{table}/_stream_load_forward behind enable_group_commit_streamload_be_forward (default false) in BE.
• Require HTTP auth for the forward handler by converting it to HttpHandlerWithAuth and passing ExecEnv from HttpService.
• Update the regression test cluster config to enable the feature flag on both FE and BE.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
regression-test/suites/load_p0/stream_load/test_group_commit_redirect.groovy	Enables the new BE config gate in the regression test cluster setup.
be/src/service/http/action/stream_load_forward_handler.h	Switches the handler base class to HttpHandlerWithAuth and adds an ExecEnv* constructor.
be/src/service/http/action/stream_load_forward_handler.cpp	Adds the runtime config gate and calls the auth hook in on_header.
be/src/service/http_service.cpp	Constructs the forward handler with _env (required for auth).
be/src/common/config.h	Declares the new BE config enable_group_commit_streamload_be_forward.
be/src/common/config.cpp	Defines the new BE config with default false.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[liaoxin01]

run buildall

[liaoxin01]

run buildall

[hello-stephen]

BE Regression && UT Coverage Report

Increment line coverage 16.67% (2/12) 🎉

Increment coverage report
Complete coverage report

Category	Coverage
Function Coverage	73.94% (27634/37375)
Line Coverage	57.58% (299914/520857)
Region Coverage	55.20% (251613/455788)
Branch Coverage	56.57% (108990/192653)

[hello-stephen]

BE Regression && UT Coverage Report

Increment line coverage 16.67% (2/12) 🎉

Increment coverage report
Complete coverage report

Category	Coverage
Function Coverage	73.94% (27634/37375)
Line Coverage	57.58% (299914/520857)
Region Coverage	55.20% (251613/455788)
Branch Coverage	56.57% (108990/192653)

[hello-stephen]

BE Regression && UT Coverage Report

Increment line coverage 16.67% (2/12) 🎉

Increment coverage report
Complete coverage report

Category	Coverage
Function Coverage	73.93% (27633/37375)
Line Coverage	57.58% (299903/520857)
Region Coverage	55.20% (251598/455788)
Branch Coverage	56.57% (108986/192653)

[hello-stephen]

BE Regression && UT Coverage Report

Increment line coverage 16.67% (2/12) 🎉

Increment coverage report
Complete coverage report

Category	Coverage
Function Coverage	73.91% (27622/37375)
Line Coverage	57.53% (299637/520857)
Region Coverage	55.07% (251014/455788)
Branch Coverage	56.49% (108827/192653)

[yiguolei]

skip buildall

[github-actions]

PR approved by at least one committer and no changes requested.

[github-actions]

PR approved by anyone and no changes requested.