Authentication and Authorization

Hello! I've been thinking a little about authentication and authorisation. A few assumptions: 1. DuckDB does not implement [roles](https://www.postgresql.org/docs/current/database-roles.html). I am 90% sure of this, based on a quick scan of documentation + my working experience. 2. Such an approach (possibly inherited / controlled by IAM / similar concepts in GCS & Azure) is the way to go 3. Extensions in DuckDB are helpful My rough proposal is that: 1. Puffin builds a (potentially lightweight) role system (obviously there is some work here). 2. This is configured for each user of puffin, and this leverages / uses cloud services to set this up (eg. parameter store in AWS) 3. This is configured at run time for puffin users via [configuration variables](https://duckdb.org/docs/sql/configuration) in DuckDB. This is a pattern that works well for s3, but as the allowed configurations are limited in DuckDB. Thankfully, extensions allow for these configuration variables to be [added to](https://github.com/duckdb/duckdb/blob/dba3b77df7a240a386f3ccd2da8249c13834576b/src/execution/operator/helper/physical_set.cpp#L30) @ghalimi have you thought about auth at all? I am happy to flesh this out a little if the above is agreeable. I think the most important point is leaning into the cloud that puffin is hosted on (point 2 above).