Core: Wire REST catalog table encryption

[hkwi]

Summary

This PR wires Iceberg table encryption into REST catalog table operations.

The REST catalog now creates a KeyManagementClient from encryption.kms-type or
encryption.kms-impl, passes it to RESTTableOperations, and returns an encryption-aware
EncryptionManager / EncryptingFileIO for encrypted tables. It also adds generated encryption
keys to REST commit requests as AddEncryptionKey metadata updates.

Background

TableOperations.encryption() defaults to a plaintext encryption manager. REST table operations
currently do not override that default, so tables configured with encryption.key-id can still use
the plaintext manager on the REST client write path.

Hive catalog already wires a KMS client into table operations and adds generated encryption keys to
table metadata before commit. This PR applies the same client-side encryption wiring to REST catalog
table operations.

Changes

• Load a KeyManagementClient in RESTSessionCatalog when KMS catalog properties are configured
• Pass the KMS client to REST table operations
• Return an encryption-aware EncryptionManager and EncryptingFileIO for encrypted REST tables
• Add generated AddEncryptionKey metadata updates to create, replace, and simple REST commits
• Reject removal or modification of encryption.key-id on existing encrypted tables
• Use a REST-local raw FileIO tracking wrapper so table loading does not initialize KMS state
• Add REST catalog tests for encrypted create transactions, missing KMS configuration, and encrypted table load behavior

Testing

• ./gradlew :iceberg-core:compileJava :iceberg-core:compileTestJava :iceberg-core:test --tests org.apache.iceberg.rest.TestRESTCatalog.testEncryptedCreateTransactionAddsEncryptionKeys --tests org.apache.iceberg.rest.TestRESTCatalog.testEncryptedCreateTransactionRequiresKmsClient --tests org.apache.iceberg.rest.TestRESTCatalog.testEncryptedTableLoadDoesNotRequireKmsClient --no-daemon
• ./gradlew :iceberg-core:test --tests org.apache.iceberg.io.TestFileIOTracker --tests org.apache.iceberg.rest.TestRESTCatalog.testCustomTableOperationsInjection --tests org.apache.iceberg.rest.TestFreshnessAwareLoading.customTableOperationsWithFreshnessAwareLoading --no-daemon
• ./gradlew :iceberg-core:spotlessCheck --no-daemon
• git diff --check

[hkwi]

I found #13225, which is already covering this area, so I'll wait for that PR instead. Closing this for now.