feat: migrate from Cedar to SpiceDB authorization system

This is a major architectural change that replaces the Cedar policy-based
authorization system with SpiceDB's relation-based authorization.

Key changes:

- Migrate from Rust to Go implementation
- Replace Cedar policies with SpiceDB schema and relationships
- Switch from envoy `ext_authz` with Cedar to SpiceDB permission checks
- Update build system and dependencies for Go ecosystem
- Maintain Envoy integration for external authorization

This change enables more flexible permission modeling through SpiceDB's
Google Zanzibar inspired relation-based system, supporting complex
hierarchical permissions that were difficult to express in Cedar.

Breaking change: Existing Cedar policies and Rust-based configuration
will no longer work and need to be migrated to SpiceDB schema.

3 files changed, 0 insertions, 82 deletions

diff --git a/vendor/bytes/src/fmt/debug.rs b/vendor/bytes/src/fmt/debug.rs
deleted file mode 100644
index 82d0aa5e..00000000
--- a/vendor/bytes/src/fmt/debug.rs
+++ /dev/null
@@ -1,40 +0,0 @@
-use core::fmt::{Debug, Formatter, Result};
-
-use super::BytesRef;
-use crate::{Bytes, BytesMut};
-
-/// Alternative implementation of `std::fmt::Debug` for byte slice.
-///
-/// Standard `Debug` implementation for `[u8]` is comma separated
-/// list of numbers. Since large amount of byte strings are in fact
-/// ASCII strings or contain a lot of ASCII strings (e. g. HTTP),
-/// it is convenient to print strings as ASCII when possible.
-impl Debug for BytesRef<'_> {
-    fn fmt(&self, f: &mut Formatter<'_>) -> Result {
-        write!(f, "b\"")?;
-        for &b in self.0 {
-            // https://doc.rust-lang.org/reference/tokens.html#byte-escapes
-            if b == b'\n' {
-                write!(f, "\\n")?;
-            } else if b == b'\r' {
-                write!(f, "\\r")?;
-            } else if b == b'\t' {
-                write!(f, "\\t")?;
-            } else if b == b'\\' || b == b'"' {
-                write!(f, "\\{}", b as char)?;
-            } else if b == b'\0' {
-                write!(f, "\\0")?;
-            // ASCII printable
-            } else if (0x20..0x7f).contains(&b) {
-                write!(f, "{}", b as char)?;
-            } else {
-                write!(f, "\\x{:02x}", b)?;
-            }
-        }
-        write!(f, "\"")?;
-        Ok(())
-    }
-}
-
-fmt_impl!(Debug, Bytes);
-fmt_impl!(Debug, BytesMut);
diff --git a/vendor/bytes/src/fmt/hex.rs b/vendor/bytes/src/fmt/hex.rs
deleted file mode 100644
index 1203b419..00000000
--- a/vendor/bytes/src/fmt/hex.rs
+++ /dev/null
@@ -1,27 +0,0 @@
-use core::fmt::{Formatter, LowerHex, Result, UpperHex};
-
-use super::BytesRef;
-use crate::{Bytes, BytesMut};
-
-impl LowerHex for BytesRef<'_> {
-    fn fmt(&self, f: &mut Formatter<'_>) -> Result {
-        for &b in self.0 {
-            write!(f, "{:02x}", b)?;
-        }
-        Ok(())
-    }
-}
-
-impl UpperHex for BytesRef<'_> {
-    fn fmt(&self, f: &mut Formatter<'_>) -> Result {
-        for &b in self.0 {
-            write!(f, "{:02X}", b)?;
-        }
-        Ok(())
-    }
-}
-
-fmt_impl!(LowerHex, Bytes);
-fmt_impl!(LowerHex, BytesMut);
-fmt_impl!(UpperHex, Bytes);
-fmt_impl!(UpperHex, BytesMut);
diff --git a/vendor/bytes/src/fmt/mod.rs b/vendor/bytes/src/fmt/mod.rs
deleted file mode 100644
index b8a0eafa..00000000
--- a/vendor/bytes/src/fmt/mod.rs
+++ /dev/null
@@ -1,15 +0,0 @@
-macro_rules! fmt_impl {
-    ($tr:ident, $ty:ty) => {
-        impl $tr for $ty {
-            fn fmt(&self, f: &mut Formatter<'_>) -> Result {
-                $tr::fmt(&BytesRef(self.as_ref()), f)
-            }
-        }
-    };
-}
-
-mod debug;
-mod hex;
-
-/// `BytesRef` is not a part of public API of bytes crate.
-struct BytesRef<'a>(&'a [u8]);