Antalya 26.3: Cache vended catalog credentials

[zvonand]

Changelog category (leave one):

• Improvement

Changelog entry (a user-readable short description of the changes that goes to CHANGELOG.md):

Add caching for REST catalog vended credentials. Added a new setting vended_credentials_cache_ttl: maximum cache entry lifetime (in seconds) for vended credentials (REST catalogs only). Default 300; 0 disables caching.

CI/CD Options

Exclude tests:

• Fast test
• Integration Tests
• Stateless tests
• Stateful tests
• Performance tests
• Aarch64 tests
• All with ASAN
• All with TSAN
• All with MSAN
• All with UBSAN
• All with Coverage
• All Regression
• Disable CI Cache

Regression jobs to run:

• Fast suites (mostly <1h)
• Aggregate Functions (2h)
• Alter (1.5h)
• Benchmark (30m)
• ClickHouse Keeper (1h)
• Iceberg (2h)
• LDAP (1h)
• OAuth (5m)
• Parquet (1.5h)
• RBAC (1.5h)
• SSL Server (1h)
• S3 (2h)
• S3 Export (2h)
• Swarms (30m)
• Tiered Storage (2h)

[github-actions]

Workflow [PR], commit [aaac3d2]

[mkmkme]

LGTM!

[DimensionWieldr]

CI Failures Analysis

Unrelated to this PR (outdated CI / base-branch drift)

• Iceberg export partition — TTL expiry permits re-export of the same partition (no catalog / glue / ice catalog): fails with EXPORT_PARTITION_ALREADY_EXPORTED. Export TTL behavior was changed in Turn system.replicated_partition_exports table into a history table by removing the TTL #1917; regression tests are already fixed, but this CI run predates that update. Safe to ignore.
• S3 export — mismatched columns (export part / export partition): expected exit code 122, got 20. Same class of issue — test expectations updated on the branch, CI not yet reflecting the fix. Safe to ignore.
• Settings (/settings/default values/*): SnapshotNotFoundError for default values>=26.3_antalya.snapshot — missing/out-of-sync snapshot in CI checkout, not related to credential caching.
• Stress test (amd_release): Cannot start clickhouse-server after leftover Hybrid-table metadata from stress iterations — flaky stress infra.
• RegressionTestsAarch64 (43 jobs): CH_ARM_BIN_GH artifact missing because this PR excluded arm builds (ci_exclude_aarch64); regression aarch64 jobs still ran. Not a functional failure of this change.

Bottom line: With the Iceberg TTL and S3 export failures explained as stale CI vs. fixes from #1917, there are no actionable PR-caused regressions left — only infra/noise (settings snapshots, stress, aarch64 artifact).