document credential vending, view rename, and ref-aware snapshot expiry
The catalog page gained a credential vending section: the delegation
header, the role flag that turns it on, and what the vended session is
scoped to. The API matrix marks ReportMetrics supported, adds RenameView
and the LoadTable snapshots parameter, and describes what concurrent
commits now do.
Maintenance: a snapshot a branch or tag points at is never expired, and a
branch's own retention governs the ancestors behind its head.
Also corrects the naming charset, which has allowed hyphens since #10093.
Chris Lu