feat: add etag conditional write support to dynamic config

[jtuglu1]

Description

Currently, competing writes to Druid dynamic configs can race with each other. This introduces the concept of conditional writes with etags, allowing clients some concurrency control over writes to Druid's dynamic config.

Callers can optionally provide an E-Tag header If-Match: <ETag> in dynamic config payloads which the server will match against and reject with a 412 code (preconditions failed) instead of potentially returning 200 success (racy overwrite). Clients can retrieve a valid E-Tag value from issuing GETs on the corresponding dynamic config endpoint (read-modify-write).

Release note

Add E-Tag conditional write support to dynamic config APIs

---

This PR has:

• been self-reviewed.
  • using the concurrency checklist (Remove this item if the PR doesn't have any relation to concurrency.)
• added documentation for new or modified features or behaviors.
• a release note entry in the PR description.
• added Javadocs for most classes and all non-trivial methods. Linked related entities via Javadoc links.
• added or updated version, license, or notice information in licenses.yaml
• added comments explaining the "why" and the intent of the code wherever would not be obvious for an unfamiliar reader.
• added unit tests or modified existing tests to cover new code paths, ensuring the threshold for code coverage is met.
• added integration tests.
• been tested in a test Druid cluster.

[FrankChen021]

Severity	Findings
P0	0
P1	1
P2	1
P3	0
Total	2

Severity	Findings
P0	0
P1	1
P2	1
P3	0
Total	2

Reviewed 21 of 21 changed files.

---

This is an automated review by Codex GPT-5.5

[FrankChen021]

Severity	Findings
P0	0
P1	1
P2	0
P3	0
Total	1

Follow-up checked: the disabled-CAS compaction path now returns a precondition failure for conditional writes, so the original issue is handled.

Reviewed 23 of 23 changed files.

---

This is an automated review by Codex GPT-5.5

[FrankChen021]

Severity	Findings
P0	0
P1	1
P2	0
P3	0
Total	1

Severity	Findings
P0	0
P1	1
P2	0
P3	0
Total	1

Follow-up checked: the disabled-CAS compaction path now returns a precondition failure for conditional writes, and ETagged GET responses now derive the body and ETag from the same byte snapshot. I found one remaining concurrency issue in conditional partial updates.

Reviewed 23 of 23 changed files.

---

This is an automated review by Codex GPT-5.5

[FrankChen021]

Severity	Findings
P0	0
P1	1
P2	0
P3	0
Total	1

I found one conditional-write gap: the unified datasource compaction POST/DELETE paths still ignore If-Match when they fall back to dynamic config writes.

Reviewed 23 of 23 changed files.

Findings that could not be attached inline:

• indexing-service/src/main/java/org/apache/druid/indexing/overlord/http/OverlordCompactionResource.java:284 - [P1] Honor If-Match on unified datasource compaction writes. When compaction supervisors are disabled, the unified datasource POST and DELETE paths still mutate the same DruidCompactionConfig document but call the configManager overloads without passing DynamicConfigEtagHelper.getIfMatch(...). A client can read an ETag for the compaction document, another writer can change it, and then the stale client can POST or DELETE /druid/indexer/v1/compaction/config/datasources/... with If-Match; the header is ignored and the write succeeds instead of returning 412. Thread the If-Match value through these datasource update/delete calls, or explicitly reject unsupported conditional writes, so conditional requests do not silently degrade to last-writer-wins.

---

This is an automated review by Codex GPT-5.5