feat(time-range-limits): add time range limits for chart queries

UPDATING.md

@@ -38,6 +38,12 @@ assists people when migrating to a new version.
   is not cached. Engines whose cancel id only exists once a query is running,
   such as Trino, still cannot cancel chart-data queries: their tasks stay
   non-abortable, as before.
+- Run `superset init` after upgrading to create the time range limits API and
+  admin-page permissions. The `TIME_RANGE_LIMITS` feature flag is off by default.
+  While it is off, supplied `time_range_limits` values are stored unchecked.
+  Review stored values before enabling it: an invalid applicable policy makes
+  queries fail closed with HTTP 503. See the
+  [time range limits configuration](https://superset.apache.org/admin-docs/configuration/time-range-limits).
 
 - **Semantic-layer schema readiness and failures.** Both provider schema hooks
   require keyword-only `readiness: SemanticCredentialReadiness` alongside

docs/docs/using-superset/issue-codes.mdx

@@ -332,3 +332,20 @@ The database was deleted.
 ```
 
 The operation failed because the database referenced no longer exists. Please reach out to your administrator for further assistance.
+
+## Issue 1042
+
+```
+The time range is outside the allowed limits, or the limits can't be verified.
+```
+
+The chart or query asks for a time range that the time range limits don't allow, or the limits that apply to it can't be read. The error's `reason_code` says which:
+
+- `MAX_SPAN_EXCEEDED`, `MAX_LOOK_BACK_EXCEEDED`, `MAX_LOOK_FORWARD_EXCEEDED`: the range is too long, starts too early or ends too late. Pick a time range inside the limits named in the error message, or ask an editor or admin to change them.
+- `UNBOUNDED_RANGE`: the range has no start or no end. Choose both. On a dashboard, ask a dashboard editor to add or scope a time range filter.
+- `NO_VALID_RANGE`: the limits leave no valid time range at all. Only an editor or admin can fix them.
+- `POLICY_UNAVAILABLE` (HTTP 503): the global, dataset or dashboard setting isn't valid, so the query is blocked until it is fixed. Retry the request, or ask an editor or admin to check the time range limits.
+
+Admins: see [Time range limits](/admin-docs/configuration/time-range-limits) for the setup, the error fields and what fails closed.
+
+The error's `actual` range uses the server's UTC offset, and its `timezone` is the server's `TZ` environment variable, or the local time zone abbreviation (for example `CEST`) when `TZ` isn't set. Set `TZ` to an IANA name (for example `America/Sao_Paulo`) to get that name instead.

docs/static/feature-flags.json

@@ -117,6 +117,13 @@
         "default": false,
         "lifecycle": "development",
         "description": "Enable Table V2 time comparison feature"
+      },
+      {
+        "name": "TIME_RANGE_LIMITS",
+        "default": false,
+        "lifecycle": "development",
+        "description": "Enforce the time range limits (see TIME_RANGE_LIMITS_GLOBAL) on chart data queries",
+        "docs": "https://superset.apache.org/admin-docs/configuration/time-range-limits"
       }
     ],
     "testing": [