(MODULES-11935) Fix default_privileges idempotency on PostgreSQL 17

[imaqsood]

Fixes MODULES-11935.

Problem

postgresql::server::default_privileges with privilege => 'ALL' and object_type => 'TABLES' is not idempotent on PostgreSQL 17+. The ALTER DEFAULT PRIVILEGES command re-runs on every Puppet run.

PostgreSQL 17 added the MAINTAIN privilege, abbreviated m, to the table privilege set. ALL ON TABLES therefore records role=arwdDxtm/grantor in pg_default_acl.defaclacl, but the unless query hard-coded arwdDxt, so it never matched.

This is pre-existing on main — it is currently failing the Debian-13 acceptance jobs in nightly, e.g. run 32823034551 (6 of 60 examples, all TABLES cases in spec/acceptance/server/default_privileges_spec.rb; the SCHEMAS cases pass because ALL ON SCHEMAS is still UC).

Change

• manifests/server/default_privileges.pp: version-gate the check string so PostgreSQL >= 17 expects arwdDxtm. Legacy dotless 9.x version strings ('96' on SLES, etc.) are normalised to 9.6 first so versioncmp does not read them as newer than 17.
• spec/acceptance/server/default_privileges_spec.rb: derive the expected ACL from postgresql_version instead of hard-coding it, in all three check queries.
• spec/defines/server/default_privileges_spec.rb + spec/spec_helper_local.rb: add a Debian 13 shared context (PostgreSQL 17) and a unit example asserting the arwdDxtm unless clause. Existing Debian 11 (PostgreSQL 13) expectations are unchanged.

Checklist

• 🟢 Spec tests. bundle exec rspec spec/defines spec/classes → 468 examples, 0 failures (puppet ~> 8.0, facter 4.10). New PG-17 example verified to fail before the manifest change and pass after.
• 🟢 Acceptance tests. Debian-13 jobs in this PR's CI are the real verification.
• Manually verified.

Not in scope

Three other jobs are red in that run for unrelated pre-existing reasons, left alone here:

• Scientific-7 / CentOS-7 / OracleLinux-7 on puppetcore8: litmusimage EL7 containers cannot start systemd on the cgroup-v2 GitHub runner (Failed to get D-Bus connection: Operation not permitted). RedHat-7 passes because it is provisioned as a real VM.
• SLES-12: ABS provisioning never opened SSH on the target.

🤖 Generated with Claude Code