What this PR does / why we need it:

User previously used three mutable list objects as constructor defaults. All users created without explicit permissions therefore shared the same roles, groups, and namespaces lists. Mutating one user's default collection could unexpectedly change another user's effective authorization state.

This change creates a fresh list for each omitted permission collection and adds a regression test covering all three fields. Explicitly supplied lists keep the existing behavior.

Which issue(s) this PR fixes:

No existing issue or pull request matched this bug. The draft PR starts the discussion as allowed by Feast's contribution guide.

Checks

• I've made sure the focused regression test is passing.
• My commits are signed off (git commit -s)
• My PR title follows conventional commits format

Testing Strategy

• Unit tests
• Integration tests
• Manual tests
• Testing is not required for this change

Validation performed:

• uvx ruff check sdk/python/feast/permissions/user.py sdk/python/tests/unit/permissions/test_user.py
• uvx ruff format --check sdk/python/feast/permissions/user.py sdk/python/tests/unit/permissions/test_user.py
• isolated execution of the new regression test with the repository source ? 1 passed

The repository's full unit-test environment did not finish resolving within the local execution window, so that limitation is documented here and the broader suite is left to CI.

Misc

Release note

Fix default Feast users sharing mutable roles, groups, and namespaces lists.

AI assistance disclosure

I identified and reproduced the issue, then used OpenAI Codex to assist with the implementation and regression-test work. I personally reviewed the resulting diff and ran the validation commands listed above to verify the fix. Any full-suite or local-environment limitations are documented in the validation section.