HDDS-11656. Default native ACL limits to user and user's primary group

[ChenSammi]

What changes were proposed in this pull request?

1. Only create ACL for user's primary group, instead of create ACL for user's each group.
2. change the default group ACL from "ALL" to "READ, LIST"
3. use getShortUserName() instead of getUserName as ACL user name. getShortUserName() is used in OM to verify ACLs long time ago.

What is the link to the Apache JIRA

https://issues.apache.org/jira/browse/HDDS-11656

How was this patch tested?

Existing unit tests and new tests.

[xichen01]

Some suggestions for this feature.

• Should we implement this on the server side too? In some scenarios, to update client side code is hard. To implement filter out the group ACL on the server side can easier to process some scenarios.

• Maybe we also need to disable the key inherit ACL, including the group ACL from the parent Object (Bucket, Prefix), which may also have a lot of group ACLs.

• If we disable the inheriting form Object ACL, then we need to implement to grant the user permissions on the key via bucket and/or prefix. thus we can control the key permissions on the bucket and prefix. But this should need a new Ozone Authorization Model implementation.

[ChenSammi]

Some suggestions for this feature.

* Should we implement this on the server side too? In some scenarios, to update client side code is hard. To implement filter out the group ACL on the server side can easier to process some scenarios.

* Maybe we also need to disable the key inherit ACL, including the group ACL from the parent Object (Bucket, Prefix), which may also have a lot of group ACLs.

* If we disable the inheriting form Object ACL, then we need to implement to grant the user permissions on the key via bucket and/or prefix. thus we can control the key permissions on the bucket and prefix. But this should need a new Ozone Authorization Model implementation.

It's a good point to move it to server side. The default ACLs of volume/bucket/keys are all ACCESS type, which will be not inherited. So we don't need to worry about that.