feat: migrate from Cedar to SpiceDB authorization system

This is a major architectural change that replaces the Cedar policy-based
authorization system with SpiceDB's relation-based authorization.

Key changes:

- Migrate from Rust to Go implementation
- Replace Cedar policies with SpiceDB schema and relationships
- Switch from envoy `ext_authz` with Cedar to SpiceDB permission checks
- Update build system and dependencies for Go ecosystem
- Maintain Envoy integration for external authorization

This change enables more flexible permission modeling through SpiceDB's
Google Zanzibar inspired relation-based system, supporting complex
hierarchical permissions that were difficult to express in Cedar.

Breaking change: Existing Cedar policies and Rust-based configuration
will no longer work and need to be migrated to SpiceDB schema.

1 files changed, 0 insertions, 108 deletions

diff --git a/vendor/rustix/src/time/clock.rs b/vendor/rustix/src/time/clock.rs
deleted file mode 100644
index bdc2b11c..00000000
--- a/vendor/rustix/src/time/clock.rs
+++ /dev/null
@@ -1,108 +0,0 @@
-use crate::{backend, io};
-
-pub use crate::timespec::{Nsecs, Secs, Timespec};
-
-/// `clockid_t`
-#[cfg(not(target_os = "wasi"))]
-pub use crate::clockid::{ClockId, DynamicClockId};
-
-/// `clock_getres(id)`—Returns the resolution of a clock.
-///
-/// # References
-///  - [POSIX]
-///  - [Linux]
-///  - [FreeBSD]
-///  - [NetBSD]
-///  - [OpenBSD]
-///  - [DragonFly BSD]
-///  - [illumos]
-///
-/// [POSIX]: https://pubs.opengroup.org/onlinepubs/9799919799/functions/clock_getres.html
-/// [Linux]: https://man7.org/linux/man-pages/man2/clock_getres.2.html
-/// [FreeBSD]: https://man.freebsd.org/cgi/man.cgi?query=clock_getres&sektion=2
-/// [NetBSD]: https://man.netbsd.org/clock_getres.2
-/// [OpenBSD]: https://man.openbsd.org/clock_getres.2
-/// [DragonFly BSD]: https://man.dragonflybsd.org/?command=clock_getres&section=2
-/// [illumos]: https://illumos.org/man/3C/clock_getres
-#[cfg(not(any(target_os = "redox", target_os = "wasi")))]
-#[inline]
-#[must_use]
-pub fn clock_getres(id: ClockId) -> Timespec {
-    backend::time::syscalls::clock_getres(id)
-}
-
-/// `clock_gettime(id)`—Returns the current value of a clock.
-///
-/// This function uses `ClockId` which only contains clocks which are known to
-/// always be supported at runtime, allowing this function to be infallible.
-/// For a greater set of clocks and dynamic clock support, see
-/// [`clock_gettime_dynamic`].
-///
-/// # References
-///  - [POSIX]
-///  - [Linux]
-///  - [FreeBSD]
-///  - [NetBSD]
-///  - [OpenBSD]
-///  - [DragonFly BSD]
-///  - [illumos]
-///
-/// [POSIX]: https://pubs.opengroup.org/onlinepubs/9799919799/functions/clock_gettime.html
-/// [Linux]: https://man7.org/linux/man-pages/man2/clock_gettime.2.html
-/// [FreeBSD]: https://man.freebsd.org/cgi/man.cgi?query=clock_getres&sektion=2
-/// [NetBSD]: https://man.netbsd.org/clock_getres.2
-/// [OpenBSD]: https://man.openbsd.org/clock_getres.2
-/// [DragonFly BSD]: https://man.dragonflybsd.org/?command=clock_getres&section=2
-/// [illumos]: https://illumos.org/man/3C/clock_gettime
-#[cfg(not(target_os = "wasi"))]
-#[inline]
-#[must_use]
-pub fn clock_gettime(id: ClockId) -> Timespec {
-    backend::time::syscalls::clock_gettime(id)
-}
-
-/// Like [`clock_gettime`] but with support for dynamic clocks.
-///
-/// # References
-///  - [POSIX]
-///  - [Linux]
-///
-/// [POSIX]: https://pubs.opengroup.org/onlinepubs/9799919799/functions/clock_gettime.html
-/// [Linux]: https://man7.org/linux/man-pages/man2/clock_gettime.2.html
-#[cfg(not(target_os = "wasi"))]
-#[inline]
-pub fn clock_gettime_dynamic(id: DynamicClockId<'_>) -> io::Result<Timespec> {
-    backend::time::syscalls::clock_gettime_dynamic(id)
-}
-
-/// `clock_settime(id, timespec)`—Sets the current value of a settable clock.
-///
-/// This fails with [`io::Errno::INVAL`] if the clock is not settable, and
-/// [`io::Errno::ACCESS`] if the current process does not have permission to
-/// set it.
-///
-/// # References
-///  - [POSIX]
-///  - [Linux]
-///  - [FreeBSD]
-///  - [NetBSD]
-///  - [OpenBSD]
-///  - [DragonFly BSD]
-///  - [illumos]
-///
-/// [POSIX]: https://pubs.opengroup.org/onlinepubs/9799919799/functions/clock_settime.html
-/// [Linux]: https://man7.org/linux/man-pages/man2/clock_settime.2.html
-/// [FreeBSD]: https://man.freebsd.org/cgi/man.cgi?query=clock_settime&sektion=2
-/// [NetBSD]: https://man.netbsd.org/clock_settime.2
-/// [OpenBSD]: https://man.openbsd.org/clock_settime.2
-/// [DragonFly BSD]: https://man.dragonflybsd.org/?command=clock_settime&section=2
-/// [illumos]: https://illumos.org/man/3C/clock_settime
-#[cfg(not(any(
-    target_os = "redox",
-    target_os = "wasi",
-    all(apple, not(target_os = "macos"))
-)))]
-#[inline]
-pub fn clock_settime(id: ClockId, timespec: Timespec) -> io::Result<()> {
-    backend::time::syscalls::clock_settime(id, timespec)
-}