feat: migrate from Cedar to SpiceDB authorization system

This is a major architectural change that replaces the Cedar policy-based
authorization system with SpiceDB's relation-based authorization.

Key changes:

- Migrate from Rust to Go implementation
- Replace Cedar policies with SpiceDB schema and relationships
- Switch from envoy `ext_authz` with Cedar to SpiceDB permission checks
- Update build system and dependencies for Go ecosystem
- Maintain Envoy integration for external authorization

This change enables more flexible permission modeling through SpiceDB's
Google Zanzibar inspired relation-based system, supporting complex
hierarchical permissions that were difficult to express in Cedar.

Breaking change: Existing Cedar policies and Rust-based configuration
will no longer work and need to be migrated to SpiceDB schema.

1 files changed, 12 insertions, 0 deletions

diff --git a/vendor/github.com/authzed/grpcutil/buf.gen.yaml b/vendor/github.com/authzed/grpcutil/buf.gen.yaml
new file mode 100644
index 00000000..729faeaf
--- /dev/null
+++ b/vendor/github.com/authzed/grpcutil/buf.gen.yaml
@@ -0,0 +1,12 @@
+#!/usr/bin/env -S go run github.com/bufbuild/buf/cmd/buf generate -o internal/testpb internal/testpb/test.proto --template
+---
+version: "v1"
+plugins:
+  - name: 'go'
+    path: ["go", "run", "google.golang.org/protobuf/cmd/protoc-gen-go"]
+    out: '.'
+    opt: 'paths=source_relative'
+  - name: 'go-grpc'
+    out: '.'
+    path: ["go", "run", "google.golang.org/grpc/cmd/protoc-gen-go-grpc"]
+    opt: 'paths=source_relative'