fix(acl): escape LIKE wildcards in user and rule search

[89799969]

What is the purpose of the change

Fixes #4229.

ACL inventory search treats % and _ as SQL LIKE wildcards instead of literal characters:

• GET /api/acl/users/page?keyword= filters username and access_key with unescaped LIKE (MybatisPlusAclRepository.findUserPage).
• GET /api/acl/rules/page?principal= / ?resource= filter principal and resource the same way (MybatisPlusAclRepository.ruleQuery).

Usernames and ACL principals commonly contain underscores (svc_monitor, prod_user). Searching for prod_user therefore also matches prodXuser, and a trailing % matches any suffix — so the inventory silently returns unrelated accounts or rules.

Brief changelog

• Add a private escapeLike helper (same behaviour as the existing QueryHistoryService.escapeLike) and apply it to user-page keywords and rule-page principal/resource filters.
• Two regression tests assert the bound LIKE value for prod_user% / svc_monitor% is escaped (%prod\_user\%%) rather than treated as a wildcard pattern.

Verifying this change

$ mvn -f server/pom.xml test -Dtest='Acl*Test,MybatisPlusAclRepositoryTest'
[INFO] Tests run: 118, Failures: 0, Errors: 0, Skipped: 0
[INFO] BUILD SUCCESS

Checkstyle: 0 violations (module validate phase).

Before the fix the two new tests fail because the bound parameters are %prod_user% / %svc_monitor%; after it they bind %prod\_user\%% / %svc\_monitor\%%.

Related peers: #4192–#4194 (audit / instance / cloud-credential LIKE escape), #4223/#4224 (Studio user search).

[RockteMQ-AI]

Summary

Same LIKE-wildcard escape pattern as #4233, applied to ACL user/rule search. Clean implementation with correct escape ordering and good test coverage including the svc_monitor underscore case.

Findings

• [Info] MybatisPlusAclRepository.java:399 — Same duplication note as #4233: escapeLike is now copy-pasted in 4+ locations. A shared utility would prevent subtle divergence.

LGTM.

[lizhimins]

Same single item as on #4224 and #4233: replace the private escapeLike copy with the shared utility in common/util, and add an explicit ESCAPE clause rather than relying on MySQL's implicit backslash (H2, used by five tests in this suite, has no default LIKE escape character).

Your own comment here says it mirrors QueryHistoryService.escapeLike, which is the duplication we want removed. Please keep the tests.

[89799969]

Same mechanical fix as requested on #4224/#4233: shared SqlLikeUtil + explicit ESCAPE clause. Tests kept.

[89799969]

@lizhimins Following up - shared SqlLikeUtil + explicit ESCAPE is pushed (26a5cd8d) and this branch is MERGEABLE/CLEAN on current rocketmq-studio. Ready for re-review.

[RockteMQ-AI]

LGTM. Code changes look good.

---

Automated review by github-manager-bot