feat: add support for aes_decrypt expression

[rafafrdz]

Summary

• Added support for Spark aes_decrypt by mapping AesDecrypt to native scalar function aes_decrypt.
• Added tests for aes_decrypt in CometStringExpressionSuite covering both:
  • default args: aes_decrypt(input, key)
  • explicit args: aes_decrypt(input, key, mode, padding, aad)
• Updated spark_expressions_support.md to mark aes_decrypt as supported.
  Closes [Feature] Support Spark expression: aes_decrypt #3188

[andygrove]

Thanks for the contribution @rafafrdz. I took a quick look and this looks nice. I kicked off CI.

On the testing side, the current tests only cover GCM mode with a 256-bit key. Since the Rust implementation also supports CBC and ECB modes with PKCS padding, and handles 128-bit, 192-bit, and 256-bit keys, it would be great to add test coverage for those combinations.

It might also be worth adding a null input test, maybe inserting a row with null encrypted data and verifying the result is null.

[rafafrdz]

Thanks for the contribution @rafafrdz. I took a quick look and this looks nice. I kicked off CI.

On the testing side, the current tests only cover GCM mode with a 256-bit key. Since the Rust implementation also supports CBC and ECB modes with PKCS padding, and handles 128-bit, 192-bit, and 256-bit keys, it would be great to add test coverage for those combinations.

It might also be worth adding a null input test, maybe inserting a row with null encrypted data and verifying the result is null.

Done 😄 @andygrove

[andygrove]

The Rust test CI failure is unrelated to this PR (a pre-existing as_slice() ambiguity in page_util.rs). Merging latest from main should fix it. All Spark test suites pass across 3.4, 3.5, and 4.0.

One thing I noticed is that AesDecrypt extends RuntimeReplaceable in Spark, so by the time Comet's serde runs it has already been replaced with a StaticInvoke. That means the CometAesDecrypt registration in miscExpressions for classOf[AesDecrypt] will never match. Only the CometAesDecryptStaticInvoke path through statics.scala is used in practice. You could simplify things by removing CometAesDecrypt and its registration in QueryPlanSerde.scala.