feat(storage): organize storage credential configs for security

[BohuTANG]

I hereby agree to the terms of the CLA available at: https://docs.databend.com/dev/policies/cla/

Summary

• Added global credential-chain controls: StorageConfig now exposes runtime-only disable_config_load and disable_instance_profile, and CredentialChainConfig replaces the previous S3-specific helper so DataOperator seeds the standardized policy for every storage operator instance.

• Tightened stage runtime policy: StageInfo carries a non-persisted allow_credential_chain flag, init_stage_operator honors it alongside role_arn, and the system history stage is auto-opted in while other stages stay locked down unless they explicitly require the ambient chain.

For compatibility, the existing disable_credential_loader field is treated as "disallow credential chain".

Tests

• Unit Test (cargo check)
• Logic Test
• Benchmark Test
• No Test - Explain why

Type of change

• Bug Fix (non-breaking change which fixes an issue)
• New Feature (non-breaking change which adds functionality)
• Breaking Change (fix or feature that could cause existing functionality not to work as expected)
• Documentation Update
• Refactoring
• Performance Improvement
• Other (please describe):

---

This change is 

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[everpcpc]

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[github-actions]

Docker Image for PR

• tag: pr-19147-2d725c2-1766571613

note: this image tag is only available for internal use.

[github-actions]

Docker Image for PR

• tag: pr-19147-ae89f6e-1766593278

note: this image tag is only available for internal use.

[github-actions]

Docker Image for PR

• tag: pr-19147-1d751e5-1766603706

note: this image tag is only available for internal use.

[everpcpc]

@codex review

[BohuTANG]

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".