[fix][admin] PIP-369 Change default value of unload-scope in ns-isolation-policy set (branch-3.0)

[Shawyeok]

Backport of #23253 to branch-3.0.

Master Issue: #23253

PIP: #23104

Motivation

set-ns-isolation-policy introduced the --unload-scope flag via PIP-369 (cherry-picked into branch-3.0 as d7af82eb6d9). The original implementation defaulted to unloading all matching namespaces when --unload-scope is not specified (unloadScope == null), which is overly aggressive and can cause mass unloads across a cluster.

The upstream fix (#23253, commit 4f002590450) changed the default so that an unspecified --unload-scope behaves like changed — only namespaces whose actual broker placement changes are unloaded. This fix was never backported to branch-3.0, leaving 3.0.x clusters vulnerable to accidental mass unloads.

In production, this was observed to trigger NamingException reconnect storms and producer/consumer disruptions across all namespaces matching the policy regex when an operator ran ns-isolation-policy set without explicitly passing --unload-scope.

Modifications

Cherry-pick of commit 4f002590450 from master onto branch-3.0, with a minor conflict resolution in CmdNamespaceIsolationPolicy.java to preserve the @Parameter annotation (branch-3.0 uses Picocli) while adopting the updated description text from the cherry-pick:

• ClustersBase.java: filterAndUnloadMatchedNamespaceAsync now treats null unloadScope the same as changed instead of falling through to the "unload all matching" branch.
• CmdNamespaceIsolationPolicy.java: Updated --unload-scope help text to reflect the new safe default.
• NamespaceIsolationDataImpl.java: Corresponding default value change.
• AdminApi2Test.java: Extended test coverage for the new default behavior.

Verifying this change

• Make sure that the change passes the CI checks.

This change is already covered by existing tests, such as AdminApi2Test (extended by this commit to cover the changed-default behavior).

Does this pull request potentially affect one of the following parts:

• Dependencies (add or upgrade a dependency)
• The public API
• The schema
• The default values of configurations
• The threading model
• The binary protocol
• The REST endpoints
• The admin CLI options
• The metrics
• Anything that affects deployment

Changed default: When --unload-scope is omitted, behavior changes from "unload all matching namespaces" to "unload only namespaces whose placement actually changes" — a significantly safer default.