feat: migrate from Cedar to SpiceDB authorization system

This is a major architectural change that replaces the Cedar policy-based
authorization system with SpiceDB's relation-based authorization.

Key changes:

- Migrate from Rust to Go implementation
- Replace Cedar policies with SpiceDB schema and relationships
- Switch from envoy `ext_authz` with Cedar to SpiceDB permission checks
- Update build system and dependencies for Go ecosystem
- Maintain Envoy integration for external authorization

This change enables more flexible permission modeling through SpiceDB's
Google Zanzibar inspired relation-based system, supporting complex
hierarchical permissions that were difficult to express in Cedar.

Breaking change: Existing Cedar policies and Rust-based configuration
will no longer work and need to be migrated to SpiceDB schema.

1 files changed, 0 insertions, 108 deletions

diff --git a/vendor/itertools/src/process_results_impl.rs b/vendor/itertools/src/process_results_impl.rs
deleted file mode 100644
index 31389c5f..00000000
--- a/vendor/itertools/src/process_results_impl.rs
+++ /dev/null
@@ -1,108 +0,0 @@
-#[cfg(doc)]
-use crate::Itertools;
-
-/// An iterator that produces only the `T` values as long as the
-/// inner iterator produces `Ok(T)`.
-///
-/// Used by [`process_results`](crate::process_results), see its docs
-/// for more information.
-#[must_use = "iterator adaptors are lazy and do nothing unless consumed"]
-#[derive(Debug)]
-pub struct ProcessResults<'a, I, E: 'a> {
-    error: &'a mut Result<(), E>,
-    iter: I,
-}
-
-impl<I, E> ProcessResults<'_, I, E> {
-    #[inline(always)]
-    fn next_body<T>(&mut self, item: Option<Result<T, E>>) -> Option<T> {
-        match item {
-            Some(Ok(x)) => Some(x),
-            Some(Err(e)) => {
-                *self.error = Err(e);
-                None
-            }
-            None => None,
-        }
-    }
-}
-
-impl<I, T, E> Iterator for ProcessResults<'_, I, E>
-where
-    I: Iterator<Item = Result<T, E>>,
-{
-    type Item = T;
-
-    fn next(&mut self) -> Option<Self::Item> {
-        let item = self.iter.next();
-        self.next_body(item)
-    }
-
-    fn size_hint(&self) -> (usize, Option<usize>) {
-        (0, self.iter.size_hint().1)
-    }
-
-    fn fold<B, F>(mut self, init: B, mut f: F) -> B
-    where
-        Self: Sized,
-        F: FnMut(B, Self::Item) -> B,
-    {
-        let error = self.error;
-        self.iter
-            .try_fold(init, |acc, opt| match opt {
-                Ok(x) => Ok(f(acc, x)),
-                Err(e) => {
-                    *error = Err(e);
-                    Err(acc)
-                }
-            })
-            .unwrap_or_else(|e| e)
-    }
-}
-
-impl<I, T, E> DoubleEndedIterator for ProcessResults<'_, I, E>
-where
-    I: Iterator<Item = Result<T, E>>,
-    I: DoubleEndedIterator,
-{
-    fn next_back(&mut self) -> Option<Self::Item> {
-        let item = self.iter.next_back();
-        self.next_body(item)
-    }
-
-    fn rfold<B, F>(mut self, init: B, mut f: F) -> B
-    where
-        F: FnMut(B, Self::Item) -> B,
-    {
-        let error = self.error;
-        self.iter
-            .try_rfold(init, |acc, opt| match opt {
-                Ok(x) => Ok(f(acc, x)),
-                Err(e) => {
-                    *error = Err(e);
-                    Err(acc)
-                }
-            })
-            .unwrap_or_else(|e| e)
-    }
-}
-
-/// “Lift” a function of the values of an iterator so that it can process
-/// an iterator of `Result` values instead.
-///
-/// [`IntoIterator`] enabled version of [`Itertools::process_results`].
-pub fn process_results<I, F, T, E, R>(iterable: I, processor: F) -> Result<R, E>
-where
-    I: IntoIterator<Item = Result<T, E>>,
-    F: FnOnce(ProcessResults<I::IntoIter, E>) -> R,
-{
-    let iter = iterable.into_iter();
-    let mut error = Ok(());
-
-    let result = processor(ProcessResults {
-        error: &mut error,
-        iter,
-    });
-
-    error.map(|_| result)
-}