GeezerVison

- Added new role `&&ut3_owner._cbac_modify_objects_role` to hold private utPLSQL objects privileges that are to be available for sources compiled with invoker-rights.

- Changed `ut_annotation_cache_manager` to be invoker rights.

- Changed `ut_suite_cache_manager` to use Code Based Access Control and use invoker rights.

…ion_cache_manager` and `ut_annotation_manager` and reorganizing code

Refactoring `ut_suite_cache_manager`, `ut_suite_manager`, `ut_annotation_cache_manager` and `ut_annotation_manager` and reorganizing code.

Update of documentation.

…or performance.

The freshness check in get_objects_to_refresh is simplified to
(c.parse_time is null or o.last_ddl_time >= cast(c.parse_time as date)).

The rollback type is now set only in reconstruct_from_cache.

Added tests for a user with partial access to test_annotation_cache.

The access check now runs in the query of ut_suite_cache_manager.get_suite_items.
Logical suites are generated from accessible rows only.
A suitepath with no accessible package below it now raises "No suite packages found for path".

ut_suite_manager built the list of suites to run through five SQL
statements over PL/SQL collections: path matching, tag filter, logical
suites, access check and sort, copying all rows each time.
ut_suite_cache_manager.get_suite_rows now does it in one static SQL
statement with named CTEs. It replaces get_suite_items,
get_cached_suite_rows, sort_and_randomize_tests, get_cached_suite_info
and ut_suite_tag_filter.apply. Both the run and get_suites_info use it.

Tags are filtered with ut_suite_tag_filter.is_matching, called from SQL.
It takes the tags as a comma-separated text, because Oracle caches a
deterministic function only when all arguments are scalars; each
distinct set of tags is then evaluated once per statement.

The table SQL macro ut_suite_cache_macros.match_paths is now the only
definition of which suite items a path selects.

Access is checked before parents are added, so a wildcard selects only
packages the user can access.

Added tests for wildcards run by a user with partial access.

…paths

configure_execution_by_path and get_suites_info share the private
refresh_cache_for_paths instead of repeating the schema resolution and
cache refresh.

get_logical_suite repeated the constructor of ut_suite,
ut_suite_context and ut_logical_suite twice, once with the items
collected one level below and once with an empty list. It now chooses
the items list first.

`can_skip_all_objects_scan` and `skip_access_check` are
replaced by `can_skip_access_check`

A run can include paths in several schemas, and their suites are siblings
at the top level of the run. They were ordered by line number and path,
so suites of different schemas could interleave.

Add the engineering principles, the refactoring rules and the rules for
code based access control and SQL macros to CONTRIBUTING.md, together
with the local constant prefix, the license header and the version
string conventions. Remove the suite cache refactoring plan, which is
done.

ut_suite_tag_filter.is_matching evaluates the postfix form of the tag
expression with a stack of booleans, instead of generating a PL/SQL block
and running it with execute immediate. The postfix form of the last
expression is cached. conv_postfix_to_infix_sql is removed.

- A tag expression made only of spaces and tabs is no tag filter, the same
  as null. Tabs are ignored like spaces.
- An empty expression, or one ending with an operator, raises the invalid
  tag expression error instead of ORA-06502.
- Tags with quotes and long expressions no longer break the generated block.
- Document that none and any are lowercase only.
- Add tests for precedence, keywords, case sensitivity, whitespace, quotes,
  many tags and three-valued logic; remove the v$sqlarea based cache test.