ZOOKEEPER-4922: Audit JAAS login, logout and Kerberos ticket renewal

[ikxeno]

Problem

ZooKeeper audits znode operations and server startup and shutdown, but JAAS login, logout and Kerberos ticket renewal are missing from the audit log. Authentication and renewal failures have no audit event identifying the principal involved.

Fix

Add login, logout and ticketRenewal events through the existing audit provider, enabled by zookeeper.audit.enable.

• Events are written in the JVM performing the JAAS operation and contain user, operation and result. The user comes from the authenticated Kerberos principal, a configured JAAS principal or the OS user. Failed renewals keep the identity from the last successful login.
• Ticket cache refresh failures and failed re-logins produce renewal failure events; skipped renewals produce none. Logout during re-login is also audited. Stopping the refresh thread alone does not emit a logout event.
• RuntimeException and LinkageError from logger initialization or writes are logged without changing the JAAS result or replacing the original LoginException.
• The logger remains fixed per JVM. Disabled client logins do not initialize it. An embedded server now rejects a different logger class after selection; configuring the same class again is allowed.

The audit documentation describes the events and logger configuration timing, marked new in 3.10.0.

Tests

• LoginAuditTest checks principal selection, event ordering, failed renewal retries, skipped attempts, logger write failures and conflicting embedded server configuration.
• The other LoginAudit*Test classes exercise disabled auditing, a client login before embedded server startup, failed logger initialization and configuration during initialization.