feat: migrate from Cedar to SpiceDB authorization system

This is a major architectural change that replaces the Cedar policy-based
authorization system with SpiceDB's relation-based authorization.

Key changes:

- Migrate from Rust to Go implementation
- Replace Cedar policies with SpiceDB schema and relationships
- Switch from envoy `ext_authz` with Cedar to SpiceDB permission checks
- Update build system and dependencies for Go ecosystem
- Maintain Envoy integration for external authorization

This change enables more flexible permission modeling through SpiceDB's
Google Zanzibar inspired relation-based system, supporting complex
hierarchical permissions that were difficult to express in Cedar.

Breaking change: Existing Cedar policies and Rust-based configuration
will no longer work and need to be migrated to SpiceDB schema.

1 files changed, 2 insertions, 16 deletions

diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 4968aa7b..d3591b4c 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -4,11 +4,9 @@ stages:
   - validate
   - runway_staging
   - runway_production
-
 variables:
   CHANGE_LOCK_OVERRIDE: true
   CONTAINER_IMAGE_COMMIT: $CI_REGISTRY_IMAGE:$CI_COMMIT_SHORT_SHA
-
 include:
   - project: 'gitlab-com/gl-infra/platform/runway/runwayctl'
     file: 'ci-tasks/service-project/runway.yml'
@@ -18,7 +16,6 @@ include:
       runway_service_id: authzd
       image: "$CONTAINER_IMAGE_COMMIT"
       runway_version: v3.66.2
-
 build image:
   image: docker:28
   interruptible: true
@@ -30,20 +27,9 @@ build image:
   script:
     - docker build --tag $CONTAINER_IMAGE_COMMIT .
     - docker push $CONTAINER_IMAGE_COMMIT
-
 unit:
-  image: rust:latest
+  image: golang:alpine
   stage: test
   needs: []
   script:
-    - make test
-
-lint:
-  image: rust:latest
-  stage: test
-  needs: []
-  before_script:
-    - rustup component add clippy rustfmt
-    - cargo install --locked cedar-policy-cli
-  script:
-    - make lint
+    - go test ./...