Fix review comments on batch composite-role expansion (N+1 reduction) - #50407

The composite-role walk in RoleUtils issues one getChildRoles query per
role node. On a cache miss this is an N+1 over the whole role tree, each
query preceded by a FlushMode.AUTO flush.

Add a bulk primitive RoleProvider.getCompositeRolesStream(realm, parentIds)
-- default resolves each parent individually, JpaRealmProvider overrides it
with a single getChildRolesFromParentIds named query (IN clause) that
hydrates the child RoleEntity rows so the follow-up getRoleById calls are
served from the persistence context. RoleStorageManager delegates to local
storage.

RoleUtils.expandCompositeRoles(session, realm, roles) uses it to expand the
tree one breadth-first level at a time: one query per level instead of one
per node, while preserving the visited-set cycle protection and dedup.

CompositeRoleExpansionQueryCountTest (jpa profile) proves it on a 31-node
wide tree (root -> 5 -> 25): the per-node walk issues 31 getChildRoles
queries, level-wise batching issues 3 (one per depth), and both produce the
same expanded role set.

Signed-off-by: Hüseyin Akdoğan <huseyin@keymate.io>

Route the composite-role expansion on the token and permission paths through
the level-wise batched RoleUtils variants so the N+1 reduction reaches the
flows the load test exercises.

Add session-aware RoleUtils.getDeepUserRoleMappings(session, realm, user) and
expandCompositeRolesStream(session, realm, roles), and switch:
 - TokenManager.getAccess: add a session-aware overload; the existing
   (UserModel, ClientModel, Stream) signature is kept and delegates to the
   per-node expansion, so the public API is unchanged,
 - DefaultClientSessionContext client-scope role expansion and user roles,
 - RolePolicyProvider (admin fine-grained permissions) deep user role mappings.

The non-session methods are kept for callers without a session. Behaviour is
unchanged: the batched expansion returns the same role set as the per-node
walk (CompositeRoleExpansionQueryCountTest); a custom RoleProvider that does
not override getCompositeRolesStream still resolves composites via the
interface default (RoleProviderCompositeDefaultTest); RoleModelTest and
CompositeRolesModelTest pass.

Signed-off-by: Hüseyin Akdoğan <huseyin@keymate.io>

- CompositeRoleExpansionQueryCountTest: require JpaConnectionProvider so the
  test is skipped rather than failing with an NPE on non-JPA backends (it
  reads Hibernate statistics via JpaConnectionProvider).
- RoleProviderCompositeDefaultTest: pass a non-null RealmModel (honoring the
  getCompositeRolesStream contract) instead of null.

Signed-off-by: Hüseyin Akdoğan <huseyin@keymate.io>

Signed-off-by: Alexander Schwartz <alexander.schwartz@ibm.com>

Signed-off-by: Alexander Schwartz <alexander.schwartz@ibm.com>

…er Keycloak strategy

Signed-off-by: Alexander Schwartz <alexander.schwartz@ibm.com>

Signed-off-by: Alexander Schwartz <alexander.schwartz@ibm.com>

- RoleUtils.expandCompositeRoles: guard against null KeycloakSession by
  falling back to per-role stack expansion when no session context is
  available (fixes r3488823474)
- RoleStorageManager.getCompositeRolesStream: split parent IDs into local
  and external; external (federated) IDs fall back to per-role
  getRoleById + getCompositesStream instead of being silently dropped
  (fixes r3488823485)
- RealmCacheSession.getCompositeRolesStream: prefix cache key with
  realm ID to prevent cross-realm key collisions; use String.join for
  a more predictable key format (fixes r3488823491)
- RealmCacheSession.getCompositeRolesStream: null-check the result of
  cache.get(parentId, CachedRole.class) before dereferencing it to
  prevent NPE on evicted entries (fixes r3488823493)
- CompositeRoleExpansionQueryCountTest.countQueries: save and restore
  Hibernate statistics enabled state to avoid affecting other tests
  (fixes r3488823497)
- CompositeRoleExpansionQueryCountTest: rename
  droppingIsCompositePreQueryHalvesGetChildRolesOnCompositeNodes to
  chainWalkIssuesOneQueryPerBreadthFirstLevel (fixes r3488823503)