feat: migrate from Cedar to SpiceDB authorization system

This is a major architectural change that replaces the Cedar policy-based
authorization system with SpiceDB's relation-based authorization.

Key changes:

- Migrate from Rust to Go implementation
- Replace Cedar policies with SpiceDB schema and relationships
- Switch from envoy `ext_authz` with Cedar to SpiceDB permission checks
- Update build system and dependencies for Go ecosystem
- Maintain Envoy integration for external authorization

This change enables more flexible permission modeling through SpiceDB's
Google Zanzibar inspired relation-based system, supporting complex
hierarchical permissions that were difficult to express in Cedar.

Breaking change: Existing Cedar policies and Rust-based configuration
will no longer work and need to be migrated to SpiceDB schema.

1 files changed, 0 insertions, 68 deletions

diff --git a/vendor/rustix/src/backend/libc/thread/cpu_set.rs b/vendor/rustix/src/backend/libc/thread/cpu_set.rs
deleted file mode 100644
index 30473b70..00000000
--- a/vendor/rustix/src/backend/libc/thread/cpu_set.rs
+++ /dev/null
@@ -1,68 +0,0 @@
-//! Rust implementation of the `CPU_*` macro API.
-
-#![allow(non_snake_case)]
-
-use super::types::{RawCpuSet, CPU_SETSIZE};
-use crate::backend::c;
-
-#[inline]
-pub(crate) fn CPU_SET(cpu: usize, cpuset: &mut RawCpuSet) {
-    assert!(
-        cpu < CPU_SETSIZE,
-        "cpu out of bounds: the cpu max is {} but the cpu is {}",
-        CPU_SETSIZE,
-        cpu
-    );
-    unsafe { c::CPU_SET(cpu, cpuset) }
-}
-
-#[inline]
-pub(crate) fn CPU_ZERO(cpuset: &mut RawCpuSet) {
-    unsafe { c::CPU_ZERO(cpuset) }
-}
-
-#[inline]
-pub(crate) fn CPU_CLR(cpu: usize, cpuset: &mut RawCpuSet) {
-    assert!(
-        cpu < CPU_SETSIZE,
-        "cpu out of bounds: the cpu max is {} but the cpu is {}",
-        CPU_SETSIZE,
-        cpu
-    );
-    unsafe { c::CPU_CLR(cpu, cpuset) }
-}
-
-#[inline]
-pub(crate) fn CPU_ISSET(cpu: usize, cpuset: &RawCpuSet) -> bool {
-    assert!(
-        cpu < CPU_SETSIZE,
-        "cpu out of bounds: the cpu max is {} but the cpu is {}",
-        CPU_SETSIZE,
-        cpu
-    );
-    unsafe { c::CPU_ISSET(cpu, cpuset) }
-}
-
-#[cfg(linux_kernel)]
-#[inline]
-pub(crate) fn CPU_COUNT(cpuset: &RawCpuSet) -> u32 {
-    unsafe { c::CPU_COUNT(cpuset).try_into().unwrap() }
-}
-
-#[inline]
-pub(crate) fn CPU_EQUAL(this: &RawCpuSet, that: &RawCpuSet) -> bool {
-    #[cfg(any(linux_like, target_os = "fuchsia", target_os = "hurd"))]
-    unsafe {
-        c::CPU_EQUAL(this, that)
-    }
-
-    #[cfg(not(any(linux_like, target_os = "fuchsia", target_os = "hurd")))]
-    unsafe {
-        for i in 0..c::CPU_SETSIZE as usize {
-            if c::CPU_ISSET(i, this) != c::CPU_ISSET(i, that) {
-                return false;
-            }
-        }
-        true
-    }
-}