[KYUUBI #7676][DOCS] Recommend multi-tenant session config safeguards

[nightcityblade]

Why are the changes needed?

The session configuration ignore and restrict lists are empty by default. In a
multi-tenant deployment, leaving both lists empty lets clients override
sensitive session-level configuration during engine bootstrap and connection
setup. This adds an explicit administrator recommendation to the existing
security documentation.

Closes #7676.

How was this patch tested?

• env PATH=/usr/bin:/bin:/usr/sbin:/sbin dev/reformat
• sphinx-build -W --keep-going -D suppress_warnings=myst.xref_missing,misc.highlighting_failure -b html docs /tmp/kyuubi-docs-build-7676-focused
• Confirmed the generated security/authorization/spark/overview.html contains
  the recommendation.

The Sphinx suppression covers existing warnings in unrelated documentation;
the changed page builds without warnings.

Was this patch assisted by generative AI tooling?

Assisted-by: OpenAI Codex:GPT-5

[aajisaka]

Greeting is somehow broken. Sending a message by hand

Hello @nightcityblade,
Thanks for finding the time to submit the Pull request, the Kyuubi community thanks you !
We really appreciate the community's efforts to improve Apache Kyuubi.
If you are new to Apache Kyuubi for code changes, please take some time to read our contributing guide.

[aajisaka]

@nightcityblade Thank you for the PR!
I feel it would be better to document sample parameter list to configure, so that Kyuubi admin can start from there. Do you have any idea?

[nightcityblade]

Thanks — I added a concrete starting policy in 44994a2. It silently keeps server-defined driver/executor memory while explicitly rejecting client changes to spark.master, spark.submit.deployMode, spark.sql.extensions, and spark.sql.optimizer.excludedRules.

The text also explains when to use the ignore versus restrict list, tells administrators to tailor the baseline, and clarifies that operation-level SET protection is configured separately below. The full Sphinx HTML build succeeds (with the same six unrelated existing warnings), and git diff --check passes.

[wForget]

@nightcityblade Thanks for your contribution. However, the documentation you modified is for the Kyuubi AuthZ Plugin For Spark SQL, which is unrelated to the configuration mentioned in this PR.

[nightcityblade]

Thanks for catching the scope mismatch. I moved the multi-tenant session-configuration guidance out of the Spark authorization plugin page and into the general Kyuubi security overview. The full Sphinx HTML build succeeds with the same six unrelated existing warnings, and git diff --check passes.