CLOUDP-350197: allow to create a custom role with cluster: true

[lsierant]

Summary

This PR fixes a problem which was preventing creating cluster-wide mongodb custom roles.

Context
As described in MongoDB docs the resource object is either:

{ db: <database>, collection: <collection> }

or

{ cluster : true }

So that means we cannot provide empty strings for db and collection fields as empty string means "any db/collection".

At the same time our previous serialization rules were always sending empty strings even if not set. This was the source of the problem - it wasn't possible to specify cluster: true because the operator was also sending empty db and collections.

Backwards compatibility
Making db and collection fields just as omitempty *string is not sufficient, because that would change the semantics of the resource and would be potentially a breaking change. In order to preserve backwards compatibility we need additional logic (see normalizePrivilegeResource that will maintain the same behavior for non-cluster-wide resources (sending empty strings even if the field is not set in yaml).

Proof of Work

Tests passing.

Based on PR #551

Chain of upstream PRs as of 2025-10-25

• PR CLOUDP-349078: custom roles regression tests #551:
  master ← lsierant/custom-roles-regression-tests

  • PR CLOUDP-350197: allow to create a custom role with cluster: true #553 (THIS ONE):
    lsierant/custom-roles-regression-tests ← lsierant/custom-roles

[vinilage]

I propose to change to: "Fixed inability to specify cluster-wide privileges in custom roles."

[lsierant]

updated, thanks!

[vinilage]

LGMT!

[vinilage]

LGTM!

[mircea-cosbuc]

LGTM!