Add enum for volume grant privileges (#3395)

## Changes
Add an enum for volume grant privileges.

Possible values are:
- `ALL_PRIVILEGES`
- `APPLY_TAG` (missing in Terraform docs but supported)
- `MANAGE`
- `READ_VOLUME`
- `WRITE_VOLUME`

It follows documented privileges in Terraform documentation:
https://registry.terraform.io/providers/databricks/databricks/latest/docs/resources/grants#volume-grants

I will add `APPLY_TAG` to Terraform as a follow-up.

## Why
Using enums gives better typing in JSON schema and allows generating
enums in Python code

## Tests
By inspecting the resulting JSON schema

Author: kanterov

NEXT_CHANGELOG.md

@@ -9,5 +9,6 @@
 ### CLI
 
 ### Bundles
+* Add supported enum values to JSON schema for volume grant privileges ([#3395](https://github.com/databricks/cli/pull/3395))
 
 ### API Changes

bundle/config/resources/volume.go

@@ -13,9 +13,36 @@ import (
 	"github.com/databricks/databricks-sdk-go/service/catalog"
 )
 
+type VolumeGrantPrivilege string
+
+const (
+	VolumeGrantPrivilegeAllPrivileges VolumeGrantPrivilege = "ALL_PRIVILEGES"
+	VolumeGrantPrivilegeApplyTag      VolumeGrantPrivilege = "APPLY_TAG"
+	VolumeGrantPrivilegeManage        VolumeGrantPrivilege = "MANAGE"
+	VolumeGrantPrivilegeReadVolume    VolumeGrantPrivilege = "READ_VOLUME"
+	VolumeGrantPrivilegeWriteVolume   VolumeGrantPrivilege = "WRITE_VOLUME"
+)
+
+// Values returns all valid VolumeGrantPrivilege values
+func (VolumeGrantPrivilege) Values() []VolumeGrantPrivilege {
+	return []VolumeGrantPrivilege{
+		VolumeGrantPrivilegeAllPrivileges,
+		VolumeGrantPrivilegeApplyTag,
+		VolumeGrantPrivilegeManage,
+		VolumeGrantPrivilegeReadVolume,
+		VolumeGrantPrivilegeWriteVolume,
+	}
+}
+
+type VolumeGrant struct {
+	Privileges []VolumeGrantPrivilege `json:"privileges"`
+
+	Principal string `json:"principal"`
+}
+
 type Volume struct {
 	// List of grants to apply on this volume.
-	Grants []Grant `json:"grants,omitempty"`
+	Grants []VolumeGrant `json:"grants,omitempty"`
 
 	// Full name of the volume (catalog_name.schema_name.volume_name). This value is read from
 	// the terraform state after deployment succeeds.

bundle/deploy/terraform/tfdyn/convert_volume_test.go

@@ -23,14 +23,18 @@ func TestConvertVolume(t *testing.T) {
 			StorageLocation: "s3://bucket/path",
 			VolumeType:      "EXTERNAL",
 		},
-		Grants: []resources.Grant{
+		Grants: []resources.VolumeGrant{
 			{
-				Privileges: []string{"READ_VOLUME"},
-				Principal:  "[email protected]",
+				Privileges: []resources.VolumeGrantPrivilege{
+					resources.VolumeGrantPrivilegeReadVolume,
+				},
+				Principal: "[email protected]",
 			},
 			{
-				Privileges: []string{"WRITE_VOLUME"},
-				Principal:  "[email protected]",
+				Privileges: []resources.VolumeGrantPrivilege{
+					resources.VolumeGrantPrivilegeWriteVolume,
+				},
+				Principal: "[email protected]",
 			},
 		},
 	}

bundle/internal/schema/annotations.yml

@@ -598,6 +598,13 @@ github.com/databricks/cli/bundle/config/resources.SqlWarehousePermission:
   "user_name":
     "description": |-
       PLACEHOLDER
+github.com/databricks/cli/bundle/config/resources.VolumeGrant:
+  "principal":
+    "description": |-
+      PLACEHOLDER
+  "privileges":
+    "description": |-
+      PLACEHOLDER
 github.com/databricks/cli/bundle/config/variable.Lookup:
   "alert":
     "description": |-

bundle/internal/schema/annotations_openapi_overrides.yml

@@ -503,6 +503,19 @@ github.com/databricks/cli/bundle/config/resources.SqlWarehousePermissionLevel:
         CAN_MONITOR
       - |-
         CAN_VIEW
+github.com/databricks/cli/bundle/config/resources.VolumeGrantPrivilege:
+  "_":
+    "enum":
+      - |-
+        ALL_PRIVILEGES
+      - |-
+        APPLY_TAG
+      - |-
+        MANAGE
+      - |-
+        READ_VOLUME
+      - |-
+        WRITE_VOLUME
 github.com/databricks/cli/bundle/config/resources.Volume:
   "_":
     "markdown_description": |-