feat: migrate from Cedar to SpiceDB authorization system

This is a major architectural change that replaces the Cedar policy-based
authorization system with SpiceDB's relation-based authorization.

Key changes:

- Migrate from Rust to Go implementation
- Replace Cedar policies with SpiceDB schema and relationships
- Switch from envoy `ext_authz` with Cedar to SpiceDB permission checks
- Update build system and dependencies for Go ecosystem
- Maintain Envoy integration for external authorization

This change enables more flexible permission modeling through SpiceDB's
Google Zanzibar inspired relation-based system, supporting complex
hierarchical permissions that were difficult to express in Cedar.

Breaking change: Existing Cedar policies and Rust-based configuration
will no longer work and need to be migrated to SpiceDB schema.

1 files changed, 0 insertions, 187 deletions

diff --git a/vendor/prost/src/message.rs b/vendor/prost/src/message.rs
deleted file mode 100644
index ee33eecd..00000000
--- a/vendor/prost/src/message.rs
+++ /dev/null
@@ -1,187 +0,0 @@
-#[cfg(not(feature = "std"))]
-use alloc::boxed::Box;
-#[cfg(not(feature = "std"))]
-use alloc::vec::Vec;
-
-use core::fmt::Debug;
-
-use bytes::{Buf, BufMut};
-
-use crate::encoding::varint::{encode_varint, encoded_len_varint};
-use crate::encoding::wire_type::WireType;
-use crate::encoding::{decode_key, message, DecodeContext};
-use crate::DecodeError;
-use crate::EncodeError;
-
-/// A Protocol Buffers message.
-pub trait Message: Debug + Send + Sync {
-    /// Encodes the message to a buffer.
-    ///
-    /// This method will panic if the buffer has insufficient capacity.
-    ///
-    /// Meant to be used only by `Message` implementations.
-    #[doc(hidden)]
-    fn encode_raw(&self, buf: &mut impl BufMut)
-    where
-        Self: Sized;
-
-    /// Decodes a field from a buffer, and merges it into `self`.
-    ///
-    /// Meant to be used only by `Message` implementations.
-    #[doc(hidden)]
-    fn merge_field(
-        &mut self,
-        tag: u32,
-        wire_type: WireType,
-        buf: &mut impl Buf,
-        ctx: DecodeContext,
-    ) -> Result<(), DecodeError>
-    where
-        Self: Sized;
-
-    /// Returns the encoded length of the message without a length delimiter.
-    fn encoded_len(&self) -> usize;
-
-    /// Encodes the message to a buffer.
-    ///
-    /// An error will be returned if the buffer does not have sufficient capacity.
-    fn encode(&self, buf: &mut impl BufMut) -> Result<(), EncodeError>
-    where
-        Self: Sized,
-    {
-        let required = self.encoded_len();
-        let remaining = buf.remaining_mut();
-        if required > remaining {
-            return Err(EncodeError::new(required, remaining));
-        }
-
-        self.encode_raw(buf);
-        Ok(())
-    }
-
-    /// Encodes the message to a newly allocated buffer.
-    fn encode_to_vec(&self) -> Vec<u8>
-    where
-        Self: Sized,
-    {
-        let mut buf = Vec::with_capacity(self.encoded_len());
-
-        self.encode_raw(&mut buf);
-        buf
-    }
-
-    /// Encodes the message with a length-delimiter to a buffer.
-    ///
-    /// An error will be returned if the buffer does not have sufficient capacity.
-    fn encode_length_delimited(&self, buf: &mut impl BufMut) -> Result<(), EncodeError>
-    where
-        Self: Sized,
-    {
-        let len = self.encoded_len();
-        let required = len + encoded_len_varint(len as u64);
-        let remaining = buf.remaining_mut();
-        if required > remaining {
-            return Err(EncodeError::new(required, remaining));
-        }
-        encode_varint(len as u64, buf);
-        self.encode_raw(buf);
-        Ok(())
-    }
-
-    /// Encodes the message with a length-delimiter to a newly allocated buffer.
-    fn encode_length_delimited_to_vec(&self) -> Vec<u8>
-    where
-        Self: Sized,
-    {
-        let len = self.encoded_len();
-        let mut buf = Vec::with_capacity(len + encoded_len_varint(len as u64));
-
-        encode_varint(len as u64, &mut buf);
-        self.encode_raw(&mut buf);
-        buf
-    }
-
-    /// Decodes an instance of the message from a buffer.
-    ///
-    /// The entire buffer will be consumed.
-    fn decode(mut buf: impl Buf) -> Result<Self, DecodeError>
-    where
-        Self: Default,
-    {
-        let mut message = Self::default();
-        Self::merge(&mut message, &mut buf).map(|_| message)
-    }
-
-    /// Decodes a length-delimited instance of the message from the buffer.
-    fn decode_length_delimited(buf: impl Buf) -> Result<Self, DecodeError>
-    where
-        Self: Default,
-    {
-        let mut message = Self::default();
-        message.merge_length_delimited(buf)?;
-        Ok(message)
-    }
-
-    /// Decodes an instance of the message from a buffer, and merges it into `self`.
-    ///
-    /// The entire buffer will be consumed.
-    fn merge(&mut self, mut buf: impl Buf) -> Result<(), DecodeError>
-    where
-        Self: Sized,
-    {
-        let ctx = DecodeContext::default();
-        while buf.has_remaining() {
-            let (tag, wire_type) = decode_key(&mut buf)?;
-            self.merge_field(tag, wire_type, &mut buf, ctx.clone())?;
-        }
-        Ok(())
-    }
-
-    /// Decodes a length-delimited instance of the message from buffer, and
-    /// merges it into `self`.
-    fn merge_length_delimited(&mut self, mut buf: impl Buf) -> Result<(), DecodeError>
-    where
-        Self: Sized,
-    {
-        message::merge(
-            WireType::LengthDelimited,
-            self,
-            &mut buf,
-            DecodeContext::default(),
-        )
-    }
-
-    /// Clears the message, resetting all fields to their default.
-    fn clear(&mut self);
-}
-
-impl<M> Message for Box<M>
-where
-    M: Message,
-{
-    fn encode_raw(&self, buf: &mut impl BufMut) {
-        (**self).encode_raw(buf)
-    }
-    fn merge_field(
-        &mut self,
-        tag: u32,
-        wire_type: WireType,
-        buf: &mut impl Buf,
-        ctx: DecodeContext,
-    ) -> Result<(), DecodeError> {
-        (**self).merge_field(tag, wire_type, buf, ctx)
-    }
-    fn encoded_len(&self) -> usize {
-        (**self).encoded_len()
-    }
-    fn clear(&mut self) {
-        (**self).clear()
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    const _MESSAGE_IS_OBJECT_SAFE: Option<&dyn Message> = None;
-}