Re: Continuous re-validation of session credentials

Hi,

Today PG validates a client's credentials only once, at connection
time.  After that the backend runs until the client disconnects, even if the
basis for the original authentication decision has gone away.  In particular:

  - the role's VALID UNTIL passes, or the role is dropped (ALTER ROLE ...
    VALID UNTIL / DROP ROLE);
  - the OAuth bearer token the session authenticated with expires;
  - the TLS client certificate the session authenticated with reaches its
    notAfter date.

In all of these cases a long-lived session keeps running with credentials that
would be rejected on a fresh connection.  For environments with short-lived
credentials (OAuth tokens, short-lived certs, time-boxed accounts) this is a
real gap: revoking access has no effect on already-established sessions.

This patch series adds an optional mechanism to periodically re-validate the
credentials of an active session and terminate it (FATAL) once they are no
longer valid.

A per-backend timer (CREDENTIAL_VALIDATION_TIMEOUT) fires every
credential_validation_interval seconds and sets a pending flag.

Validation has two layers:
    - A baseline, auth-method-independent check (role still exists and has not
      passed rolvaliduntil), applied to every authenticated session.
    - Optional method-specific validators, registered via
      RegisterCredentialValidator(), for OAuth token expiry and client
      certificate expiry.

The framework is deliberately extensible: adding re-validation for a new

 authentication method needs only three small steps -- add a
 CredentialValidationType, implement a "bool validator(void)" callback that
 returns whether the credential is still valid, and register it with
 RegisterCredentialValidator().  The certificate and OAuth validators in 0002 

 and 0003 are  themselves examples of plugging into the framework this way, 

 so methods such  as LDAP, RADIUS, or GSSAPI/Kerberos credential lifetimes

 could be added later  without touching the core.

Two GUCs :

    credential_validation_enabled   (bool, default off)
    credential_validation_interval  (int, 5..3600 s, default 60)

Patch series

------------

  0001  Framework + baseline role-validity check (rolvaliduntil / role
        existence).  Useful on its own for password/md5/scram sessions.
  0002  TLS client certificate expiry.  The cert presented at connect time is
        retained on the Port, so its notAfter is re-checked locally with no
        network round-trip.
  0003  OAuth token expiry.  This adds an optional expire_cb callback to
        OAuthValidatorCallbacks; to stay ABI-compatible the validator magic is
        versioned (V1 = existing layout, V2 = adds expire_cb), and the server
        accepts both.

Request a review.

Thanks & Best Regards,

Ajit