feat: migrate from Cedar to SpiceDB authorization system

This is a major architectural change that replaces the Cedar policy-based
authorization system with SpiceDB's relation-based authorization.

Key changes:

- Migrate from Rust to Go implementation
- Replace Cedar policies with SpiceDB schema and relationships
- Switch from envoy `ext_authz` with Cedar to SpiceDB permission checks
- Update build system and dependencies for Go ecosystem
- Maintain Envoy integration for external authorization

This change enables more flexible permission modeling through SpiceDB's
Google Zanzibar inspired relation-based system, supporting complex
hierarchical permissions that were difficult to express in Cedar.

Breaking change: Existing Cedar policies and Rust-based configuration
will no longer work and need to be migrated to SpiceDB schema.

3 files changed, 52 insertions, 0 deletions

diff --git a/vendor/github.com/xlgmokha/x/pkg/env/env.go b/vendor/github.com/xlgmokha/x/pkg/env/env.go
new file mode 100644
index 00000000..24fb519a
--- /dev/null
+++ b/vendor/github.com/xlgmokha/x/pkg/env/env.go
@@ -0,0 +1,22 @@
+package env
+
+import (
+	"os"
+	"strings"
+)
+
+func Fetch(key string, defaultValue string) string {
+	if x := os.Getenv(key); x != "" {
+		return x
+	}
+	return defaultValue
+}
+
+func Variables() Vars {
+	items := Vars{}
+	for _, line := range os.Environ() {
+		segments := strings.SplitN(line, "=", 2)
+		items[segments[0]] = segments[1]
+	}
+	return items
+}
diff --git a/vendor/github.com/xlgmokha/x/pkg/env/vars.go b/vendor/github.com/xlgmokha/x/pkg/env/vars.go
new file mode 100644
index 00000000..aad050ab
--- /dev/null
+++ b/vendor/github.com/xlgmokha/x/pkg/env/vars.go
@@ -0,0 +1,3 @@
+package env
+
+type Vars map[string]string
diff --git a/vendor/github.com/xlgmokha/x/pkg/env/with.go b/vendor/github.com/xlgmokha/x/pkg/env/with.go
new file mode 100644
index 00000000..6efeed46
--- /dev/null
+++ b/vendor/github.com/xlgmokha/x/pkg/env/with.go
@@ -0,0 +1,27 @@
+package env
+
+import (
+	"os"
+)
+
+func With(env Vars, callback func()) {
+	original := Vars{}
+
+	for key, value := range env {
+		if val, ok := os.LookupEnv(key); ok {
+			original[key] = val
+		}
+		os.Setenv(key, value)
+	}
+
+	defer func() {
+		for key, _ := range env {
+			os.Unsetenv(key)
+		}
+		for key, value := range original {
+			os.Setenv(key, value)
+		}
+	}()
+
+	callback()
+}