security: store ACLs in a non-contiguous chunked set

[WillemKauf]

acl_store::_acls was an absl::node_hash_map, chosen for reference stability. Unfortunately this means allocations are contiguous, which can lead to oversized allocations and OOMs.

Rewrite it using chunked_hash_set; because reference stability across insertions/erasures is still required, we use a second layer of indirection via std::unique_ptr<> to acl_nodes.

Backports Required

• none - not a bug fix
• none - this is a backport
• none - issue does not exist in previous branches
• none - papercut/not impactful enough to backport
• v26.1.x
• v25.3.x
• v25.2.x

Release Notes

Improvements

• Prevent oversized allocations/OOMs when using a large number of ACLs in redpanda

[Copilot]

Pull request overview

Refactors the security::acl_store internal ACL map to avoid large contiguous allocations that can lead to OOMs when many ACLs are present, while preserving the reference-stability requirements used by authorization lookups and the prefix index.

Changes:

• Replace _acls storage from absl::node_hash_map to chunked_hash_map and introduce a std::unique_ptr-owned node to keep referenced data address-stable.
• Update ACL lookup, iteration, removal, and reset paths to dereference the new node layout (pattern/entries).
• Add Bazel dependency for chunked_hash_map.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File	Description
src/v/security/BUILD	Adds //src/v/container:chunked_hash_map dependency for the new container usage in acl_store.
src/v/security/acl.cc	Updates lookups/iteration/removal to use _acls values as heap-stable nodes (unique_ptr indirection).
src/v/security/acl_store.h	Replaces _acls type with chunked_hash_map + heap node indirection to preserve reference stability without large contiguous allocations.

Comments suppressed due to low confidence (1)

src/v/security/acl_store.h:112

• chunked_hash_map’s default hashers (see container/chunked_hash_map.h) return uint64_t and are noexcept. This custom hasher returns size_t and isn’t marked noexcept; matching the 64-bit/noexcept pattern would keep hashing consistent with other chunked_hash_map users and avoids any potential truncation on non-64-bit platforms.

    struct resource_pattern_hash {
        using is_transparent = void;
        // absl::HashOf already mixes well; tell unordered_dense not to re-mix.
        using is_avalanching = void;
        size_t operator()(const auto& p) const {
            return absl::HashOf(pattern_key(p));
        }
    };

[vbotbuildovich]

CI test results

test results on build#86529

test_status	test_class	test_method	test_arguments	test_kind	job_url	passed	reason	test_history
FLAKY(PASS)	EndToEndCloudTopicsMaintenanceToggleTest	test_toggle_maintenance	null	integration	https://buildkite.com/redpanda/redpanda/builds/86529#019f19e7-f7a7-4a82-bcb9-83550c5e23d2	10/11	Test PASSES after retries.No significant increase in flaky rate(baseline=0.0000, p0=1.0000, reject_threshold=0.0100. adj_baseline=0.1000, p1=0.3487, trust_threshold=0.5000)	https://redpanda.metabaseapp.com/dashboard/87-tests?tab=142-dt-individual-test-history&test_class=EndToEndCloudTopicsMaintenanceToggleTest&test_method=test_toggle_maintenance

[oleiman]

nice. i also had assumed we needed resource_pattern lookups on _acls.

[nguyen-andrew]

Late comment, but should we consider making the pattern const?

[WillemKauf]

#30974