[Broker] Adjust the validation for policy schemaCompatibilityStrategy

[yuruguo]

Motivation

In #13297, We should not add GET_SCHEMA_COMPATIBILITY_STRATEGY and SET_SCHEMA_COMPATIBILITY_STRATEGY topic operation and complete the permission check on policy schemaCompatibilityStrategy by method validateTopicOperationAsync(), because schemaCompatibilityStrategy is a topic policy not a topic operation, we should use method validateTopicPolicyOperation() to complete.

Documentation

• no-need-doc

[Jason918]

LGTM

[nodece]

LGTM

[eolivelli]

Lgtm

CN you please remember me the PIP in which we are changing all the permissions?

[nodece]

Lgtm

CN you please remember me the PIP in which we are changing all the permissions?

@eolivelli Sorry, I should make a PIP for #13297. Do we need to make PIR for these changes?

[eolivelli]

I mean that during the past months I have seen many patches around permission validation.
I wonder if there is a general umbrella issue or some PIP.
This kind of changes must be documented carefully in the release notes, because they have a big impact on security

[gaoran10]

Could we add a test for this?

[codelipenghui]

@yuruguo The change looks good to me, could you please help add a test?

[codelipenghui]

@eolivelli We don't have a release that contains #13297, so it will not have a big impact on security. The issue is #13297 implementation does not follow the current topic policy permission handling way.

I wonder if there is a general umbrella issue or some PIP.

😭, looks this is a feature #6428 that was added almost 2 years ago, and no PIP there.

[yuruguo]

@codelipenghui @315157973 @gaoran10 The test has added and PTAL again, thx!

[codelipenghui]

After checking the current implementation, looks like the PolicyName and PolicyOperation are only for the exception messages, only the tenant admin can access the topic policies.