A user who holds only read on a dataset (which authorises
indices:data/read/esql/resolve_datasets) was able to discover the dataset's
full storage location — S3 bucket, GCS bucket, Azure container, object key,
prefix — through two independent routes:

1. Failed-query error messages. Every storage layer (S3, GCS, Azure), every
   resolver stage (ExternalSourceResolver, FormatNameResolver), and every
   format reader (ParquetFormatReader) embedded the path directly into
   exception messages. Those messages crossed the node boundary and reached the
   user verbatim in the reason / caused_by chain.




2. Profile plan strings on success. With profile: true, every entry in
   profile.plans contained the full storage URI via ExternalSourceExec's
   node string.

The right that separates these two callers already exists:
indices:admin/esql/dataset/get (granted by read_dataset_metadata,
manage_dataset, manage, or all). This PR makes both paths consult it.

What changed

Error-message path

• Strip path at every composing site. All IOException /
  IllegalArgumentException constructions across S3, GCS, Azure storage
  objects and providers, FormatNameResolver, ExternalSourceResolver,
  ParquetFormatReader, FileSourceFactory, and TableCatalog now name the
  operation and condition without embedding the path.
  ExternalFailures.resolutionFailureMessage was deleted; its call sites use
  ExternalFailures.rootDetail(e) directly (path-free, wrapper-transparent).




• Carry location in a structured field. ExternalFailures.LocatedException
  wraps every resolution-path failure as a pair: an unlocated form (no path)
  and a located form (path reinstated). The coordinator selects between them
  based on privilege.




• One privilege check on the coordinator. EsqlSession checks
  indices:admin/esql/dataset/get via HasPrivilegesRequest after the
  caller's thread context is restored. The result (canSeeDatasetLocation) is
  stored on Configuration behind a new TransportVersion
  (esql_dataset_location_visible) so data nodes receive it too. Security-
  disabled clusters short-circuit to true.




• Reinstatement. reinstateLocationIfAuthorized in EsqlSession resolves
  every LocatedException to its located or unlocated form before the failure
  reaches the user.

Profile/EXPLAIN plan path

• 
  NodeStringMapper gains an abstract location(String) method.
  IDENTITY.location() returns verbatim; new REDACT_LOCATION.location()
  returns "[redacted]".


• 
  ExternalSourceExec.nodeString() and ExternalRelation.nodeString() now
  call mapper.location(sourcePath) instead of mapper.opaque(sourcePath).


• 
  ComputeService and all three EXPLAIN rendering call sites in EsqlSession
  select the mapper from configuration.canSeeDatasetLocation().

Closes: elastic/esql-planning#1981