Fix fail-open authorization for pipe config plans

[Caideyipi]

Summary

• Deny unknown config plans received through the ConfigNode pipe receiver.
• Restrict consensus writes to explicitly authorized, supported template plans.
• Add an integration regression test covering a CreatePipePluginPlan carrying attacker-controlled class and JAR bytes.

Verification

• ConfigNode test-compile
• PipeConfigNodeThriftRequestTest (10/10)
• IoTDBPipeReceiverIT (7/7)
• Spotless, Checkstyle, and git diff --check

[codecov]

Codecov Report

❌ Patch coverage is 0% with 7 lines in your changes missing coverage. Please review.
✅ Project coverage is 43.95%. Comparing base (cec4f9b) to head (519354e).
⚠️ Report is 4 commits behind head on master.

Files with missing lines	Patch %	Lines
...ipe/receiver/protocol/IoTDBConfigNodeReceiver.java	0.00%	7 Missing ⚠️

Additional details and impacted files

@@             Coverage Diff              @@
##             master   #18488      +/-   ##
============================================
+ Coverage     43.68%   43.95%   +0.27%     
  Complexity      374      374              
============================================
  Files          5401     5402       +1     
  Lines        387285   388205     +920     
  Branches      50513    50695     +182     
============================================
+ Hits         169168   170638    +1470     
+ Misses       218117   217567     -550     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[sonarqubecloud]

Quality Gate failed

Failed conditions
B Reliability Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE