feat: migrate from Cedar to SpiceDB authorization system

This is a major architectural change that replaces the Cedar policy-based
authorization system with SpiceDB's relation-based authorization.

Key changes:

- Migrate from Rust to Go implementation
- Replace Cedar policies with SpiceDB schema and relationships
- Switch from envoy `ext_authz` with Cedar to SpiceDB permission checks
- Update build system and dependencies for Go ecosystem
- Maintain Envoy integration for external authorization

This change enables more flexible permission modeling through SpiceDB's
Google Zanzibar inspired relation-based system, supporting complex
hierarchical permissions that were difficult to express in Cedar.

Breaking change: Existing Cedar policies and Rust-based configuration
will no longer work and need to be migrated to SpiceDB schema.

1 files changed, 0 insertions, 153 deletions

diff --git a/vendor/httparse/src/simd/mod.rs b/vendor/httparse/src/simd/mod.rs
deleted file mode 100644
index 0e4493a5..00000000
--- a/vendor/httparse/src/simd/mod.rs
+++ /dev/null
@@ -1,153 +0,0 @@
-mod swar;
-
-#[cfg(not(all(
-    httparse_simd,
-    any(
-        target_arch = "x86",
-        target_arch = "x86_64",
-        all(
-            target_arch = "aarch64",
-            httparse_simd_neon_intrinsics,
-        )
-    ),
-)))]
-pub use self::swar::*;
-
-#[cfg(all(
-    httparse_simd,
-    not(httparse_simd_target_feature_avx2),
-    any(
-        target_arch = "x86",
-        target_arch = "x86_64",
-    ),
-))]
-mod sse42;
-
-#[cfg(all(
-    httparse_simd,
-    any(
-        httparse_simd_target_feature_avx2,
-        not(httparse_simd_target_feature_sse42),
-    ),
-    any(
-        target_arch = "x86",
-        target_arch = "x86_64",
-    ),
-))]
-mod avx2;
-
-#[cfg(all(
-    httparse_simd,
-    not(any(
-        httparse_simd_target_feature_sse42,
-        httparse_simd_target_feature_avx2,
-    )),
-    any(
-        target_arch = "x86",
-        target_arch = "x86_64",
-    ),
-))]
-mod runtime;
-
-#[cfg(all(
-    httparse_simd,
-    not(any(
-        httparse_simd_target_feature_sse42,
-        httparse_simd_target_feature_avx2,
-    )),
-    any(
-        target_arch = "x86",
-        target_arch = "x86_64",
-    ),
-))]
-pub use self::runtime::*;
-
-#[cfg(all(
-    httparse_simd,
-    httparse_simd_target_feature_sse42,
-    not(httparse_simd_target_feature_avx2),
-    any(
-        target_arch = "x86",
-        target_arch = "x86_64",
-    ),
-))]
-mod sse42_compile_time {
-    #[inline(always)]
-    pub fn match_header_name_vectored(b: &mut crate::iter::Bytes<'_>) {
-        super::swar::match_header_name_vectored(b);
-    }
-
-    #[inline(always)]
-    pub fn match_uri_vectored(b: &mut crate::iter::Bytes<'_>) {
-        // SAFETY: calls are guarded by a compile time feature check
-        unsafe { crate::simd::sse42::match_uri_vectored(b) }
-    }
-    
-    #[inline(always)]
-    pub fn match_header_value_vectored(b: &mut crate::iter::Bytes<'_>) {
-        // SAFETY: calls are guarded by a compile time feature check
-        unsafe { crate::simd::sse42::match_header_value_vectored(b) }
-    }
-}
-
-#[cfg(all(
-    httparse_simd,
-    httparse_simd_target_feature_sse42,
-    not(httparse_simd_target_feature_avx2),
-    any(
-        target_arch = "x86",
-        target_arch = "x86_64",
-    ),
-))]
-pub use self::sse42_compile_time::*;
-
-#[cfg(all(
-    httparse_simd,
-    httparse_simd_target_feature_avx2,
-    any(
-        target_arch = "x86",
-        target_arch = "x86_64",
-    ),
-))]
-mod avx2_compile_time {
-    #[inline(always)]
-    pub fn match_header_name_vectored(b: &mut crate::iter::Bytes<'_>) {
-        super::swar::match_header_name_vectored(b);
-    }
-
-    #[inline(always)]
-    pub fn match_uri_vectored(b: &mut crate::iter::Bytes<'_>) {
-        // SAFETY: calls are guarded by a compile time feature check
-        unsafe { crate::simd::avx2::match_uri_vectored(b) }
-    }
-    
-    #[inline(always)]
-    pub fn match_header_value_vectored(b: &mut crate::iter::Bytes<'_>) {
-        // SAFETY: calls are guarded by a compile time feature check
-        unsafe { crate::simd::avx2::match_header_value_vectored(b) }
-    }
-}
-
-#[cfg(all(
-    httparse_simd,
-    httparse_simd_target_feature_avx2,
-    any(
-        target_arch = "x86",
-        target_arch = "x86_64",
-    ),
-))]
-pub use self::avx2_compile_time::*;
-
-#[cfg(all(
-    httparse_simd,
-    target_arch = "aarch64",
-    httparse_simd_neon_intrinsics,
-))]
-mod neon;
-
-#[cfg(all(
-    httparse_simd,
-    target_arch = "aarch64",
-    httparse_simd_neon_intrinsics,
-))]
-pub use self::neon::*;