feat: migrate from Cedar to SpiceDB authorization system

This is a major architectural change that replaces the Cedar policy-based
authorization system with SpiceDB's relation-based authorization.

Key changes:

- Migrate from Rust to Go implementation
- Replace Cedar policies with SpiceDB schema and relationships
- Switch from envoy `ext_authz` with Cedar to SpiceDB permission checks
- Update build system and dependencies for Go ecosystem
- Maintain Envoy integration for external authorization

This change enables more flexible permission modeling through SpiceDB's
Google Zanzibar inspired relation-based system, supporting complex
hierarchical permissions that were difficult to express in Cedar.

Breaking change: Existing Cedar policies and Rust-based configuration
will no longer work and need to be migrated to SpiceDB schema.

1 files changed, 0 insertions, 93 deletions

diff --git a/vendor/itertools/src/tee.rs b/vendor/itertools/src/tee.rs
deleted file mode 100644
index 0984c5de..00000000
--- a/vendor/itertools/src/tee.rs
+++ /dev/null
@@ -1,93 +0,0 @@
-use super::size_hint;
-
-use alloc::collections::VecDeque;
-use alloc::rc::Rc;
-use std::cell::RefCell;
-
-/// Common buffer object for the two tee halves
-#[derive(Debug)]
-struct TeeBuffer<A, I> {
-    backlog: VecDeque<A>,
-    iter: I,
-    /// The owner field indicates which id should read from the backlog
-    owner: bool,
-}
-
-/// One half of an iterator pair where both return the same elements.
-///
-/// See [`.tee()`](crate::Itertools::tee) for more information.
-#[must_use = "iterator adaptors are lazy and do nothing unless consumed"]
-#[derive(Debug)]
-pub struct Tee<I>
-where
-    I: Iterator,
-{
-    rcbuffer: Rc<RefCell<TeeBuffer<I::Item, I>>>,
-    id: bool,
-}
-
-pub fn new<I>(iter: I) -> (Tee<I>, Tee<I>)
-where
-    I: Iterator,
-{
-    let buffer = TeeBuffer {
-        backlog: VecDeque::new(),
-        iter,
-        owner: false,
-    };
-    let t1 = Tee {
-        rcbuffer: Rc::new(RefCell::new(buffer)),
-        id: true,
-    };
-    let t2 = Tee {
-        rcbuffer: t1.rcbuffer.clone(),
-        id: false,
-    };
-    (t1, t2)
-}
-
-impl<I> Iterator for Tee<I>
-where
-    I: Iterator,
-    I::Item: Clone,
-{
-    type Item = I::Item;
-    fn next(&mut self) -> Option<Self::Item> {
-        // .borrow_mut may fail here -- but only if the user has tied some kind of weird
-        // knot where the iterator refers back to itself.
-        let mut buffer = self.rcbuffer.borrow_mut();
-        if buffer.owner == self.id {
-            match buffer.backlog.pop_front() {
-                None => {}
-                some_elt => return some_elt,
-            }
-        }
-        match buffer.iter.next() {
-            None => None,
-            Some(elt) => {
-                buffer.backlog.push_back(elt.clone());
-                buffer.owner = !self.id;
-                Some(elt)
-            }
-        }
-    }
-
-    fn size_hint(&self) -> (usize, Option<usize>) {
-        let buffer = self.rcbuffer.borrow();
-        let sh = buffer.iter.size_hint();
-
-        if buffer.owner == self.id {
-            let log_len = buffer.backlog.len();
-            size_hint::add_scalar(sh, log_len)
-        } else {
-            sh
-        }
-    }
-}
-
-impl<I> ExactSizeIterator for Tee<I>
-where
-    I: ExactSizeIterator,
-    I::Item: Clone,
-{
-}