Add AAA Klish CLI transformer and YANG annotations

[devin-ai-integration]

Add AAA OpenConfig-to-SONiC transformer and YANG annotations

Summary

Adds the transformer layer for mapping OpenConfig AAA YANG model (openconfig-aaa.yang) to SONiC's native AAA ConfigDB table (sonic-system-aaa.yang). This is the sonic-mgmt-common half of the Klish AAA CLI feature (the sonic-mgmt-framework half with XML/actioner/template is in a separate PR).

New files:

• openconfig-aaa-sonic-ext.yang — YANG augmentation adding SONiC-specific failthrough, fallback, and debug boolean leaves to the OpenConfig AAA authentication config/state containers (these fields exist in SONiC's sonic-system-aaa.yang but not in standard OpenConfig AAA)
• openconfig-aaa-annot.yang — Deviation-based annotations mapping OpenConfig authentication/authorization/accounting containers to AAA table with key and field transformers, plus field-name mappings for the augmented boolean leaves
• xfmr_aaa.go — Key transformer (aaa_tbl_key_xfmr) that routes by URI path, plus 6 field transformers for converting between OpenConfig leaf-list and SONiC comma-separated login string
• xfmr_aaa_test.go — Unit tests for the two helper conversion functions (aaaMethodListToLoginString, aaaLoginStringToMethodList) including round-trip tests

Updates since last revision

• Added openconfig-aaa-sonic-ext.yang: Created a YANG augmentation module that adds failthrough, fallback, and debug leaves to OpenConfig AAA's authentication config and state containers. Without this, the REST paths used by the actioner for these fields would have no backing YANG definition.
• Added boolean field annotations: The annotation file now includes sonic-ext:field-name deviations for the three augmented boolean leaves (config + state), mapping them directly to their SONiC DB field names.
• Updated annotation file imports: Added import openconfig-aaa-sonic-ext to resolve the augmented leaf paths in deviation statements.

Review & Testing Checklist for Human

Risk level: 🟡 YELLOW — New YANG augmentation pattern, uncompiled Go code, and two-repo dependency make this non-trivial to validate without a build.

• YANG augmentation correctness: The new openconfig-aaa-sonic-ext.yang augments the OpenConfig AAA model to add SONiC-specific boolean fields. Verify that the YANG tooling correctly resolves the augmented leaf paths in the annotation file's deviations (e.g., /oc-aaa:aaa/oc-aaa:authentication/oc-aaa:config/oc-aaa-sonic-ext:failthrough). There is only one other extension YANG in this repo (openconfig-mclag.yang) and it does not use augment in the same way, so this pattern may be untested.
• Build verification: This Go code was never compiled. Verify that all referenced types (KeyXfmrYangToDb, FieldXfmrYangToDb, FieldXfmrDbtoYang, XfmrParams, NewPathInfo, XlateFuncBind) exist with correct signatures and that the code builds without errors.
• Annotation semantics: Each *-method leaf has both sonic-ext:field-name "login" AND sonic-ext:field-transformer. Verify that the framework handles this correctly (typically field-transformer takes precedence, making field-name redundant or potentially conflicting).
• Missing top-level annotation: There's no deviation for /oc-aaa:aaa itself. The actioner does GET /restconf/data/openconfig-aaa:aaa for show commands. Verify that the framework can route this GET request without a top-level annotation, or add one if needed.
• DbToYang hardcoded keys: Each DbToYang_* transformer hardcodes the AAA entry key lookup (e.g., aaaEntry["authentication"]). Verify this matches how the framework invokes field transformers — if the framework expects the transformer to use inParams.key dynamically, this will break.

Test Plan

1. Build sonic-mgmt-common with these changes and verify no compilation errors
2. Verify YANG models load correctly (pyang validation, YANG tooling doesn't reject the augmentation)
3. Deploy to a test DUT with the corresponding sonic-mgmt-framework PR
4. Test config commands: aaa authentication login tacacs+ local, aaa authentication failthrough enable, etc.
5. Verify ConfigDB entries are created correctly: redis-cli HGETALL "AAA|authentication"
6. Test show command: show aaa should display all configured values including boolean fields
7. Test bidirectional transformation: configure via CLI, verify in DB, then read back via show command

Notes

• This PR is part of a larger Klish AAA CLI migration from Click (sonic-utilities) to Klish (sonic-mgmt-framework)
• Companion PR in sonic-mgmt-framework adds XML commands, Python actioner, and Jinja2 template: Add AAA Klish CLI commands, actioner, template, and HLD sonic-mgmt-framework#2
• Python actioner tests achieved 97% coverage, but Go transformer tests only cover helper functions, not the actual transformer callbacks
• Link to Devin run: https://cisco-demo.devinenterprise.com/sessions/dac62833768e40b09aeafb00c78f66be
• Requested by: @arthurkkp-cog

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment and CI monitoring