feat: migrate from Cedar to SpiceDB authorization system

This is a major architectural change that replaces the Cedar policy-based
authorization system with SpiceDB's relation-based authorization.

Key changes:

- Migrate from Rust to Go implementation
- Replace Cedar policies with SpiceDB schema and relationships
- Switch from envoy `ext_authz` with Cedar to SpiceDB permission checks
- Update build system and dependencies for Go ecosystem
- Maintain Envoy integration for external authorization

This change enables more flexible permission modeling through SpiceDB's
Google Zanzibar inspired relation-based system, supporting complex
hierarchical permissions that were difficult to express in Cedar.

Breaking change: Existing Cedar policies and Rust-based configuration
will no longer work and need to be migrated to SpiceDB schema.

3 files changed, 0 insertions, 178 deletions

diff --git a/vendor/rustix/src/time/clock.rs b/vendor/rustix/src/time/clock.rs
deleted file mode 100644
index bdc2b11c..00000000
--- a/vendor/rustix/src/time/clock.rs
+++ /dev/null
@@ -1,108 +0,0 @@
-use crate::{backend, io};
-
-pub use crate::timespec::{Nsecs, Secs, Timespec};
-
-/// `clockid_t`
-#[cfg(not(target_os = "wasi"))]
-pub use crate::clockid::{ClockId, DynamicClockId};
-
-/// `clock_getres(id)`—Returns the resolution of a clock.
-///
-/// # References
-///  - [POSIX]
-///  - [Linux]
-///  - [FreeBSD]
-///  - [NetBSD]
-///  - [OpenBSD]
-///  - [DragonFly BSD]
-///  - [illumos]
-///
-/// [POSIX]: https://pubs.opengroup.org/onlinepubs/9799919799/functions/clock_getres.html
-/// [Linux]: https://man7.org/linux/man-pages/man2/clock_getres.2.html
-/// [FreeBSD]: https://man.freebsd.org/cgi/man.cgi?query=clock_getres&sektion=2
-/// [NetBSD]: https://man.netbsd.org/clock_getres.2
-/// [OpenBSD]: https://man.openbsd.org/clock_getres.2
-/// [DragonFly BSD]: https://man.dragonflybsd.org/?command=clock_getres&section=2
-/// [illumos]: https://illumos.org/man/3C/clock_getres
-#[cfg(not(any(target_os = "redox", target_os = "wasi")))]
-#[inline]
-#[must_use]
-pub fn clock_getres(id: ClockId) -> Timespec {
-    backend::time::syscalls::clock_getres(id)
-}
-
-/// `clock_gettime(id)`—Returns the current value of a clock.
-///
-/// This function uses `ClockId` which only contains clocks which are known to
-/// always be supported at runtime, allowing this function to be infallible.
-/// For a greater set of clocks and dynamic clock support, see
-/// [`clock_gettime_dynamic`].
-///
-/// # References
-///  - [POSIX]
-///  - [Linux]
-///  - [FreeBSD]
-///  - [NetBSD]
-///  - [OpenBSD]
-///  - [DragonFly BSD]
-///  - [illumos]
-///
-/// [POSIX]: https://pubs.opengroup.org/onlinepubs/9799919799/functions/clock_gettime.html
-/// [Linux]: https://man7.org/linux/man-pages/man2/clock_gettime.2.html
-/// [FreeBSD]: https://man.freebsd.org/cgi/man.cgi?query=clock_getres&sektion=2
-/// [NetBSD]: https://man.netbsd.org/clock_getres.2
-/// [OpenBSD]: https://man.openbsd.org/clock_getres.2
-/// [DragonFly BSD]: https://man.dragonflybsd.org/?command=clock_getres&section=2
-/// [illumos]: https://illumos.org/man/3C/clock_gettime
-#[cfg(not(target_os = "wasi"))]
-#[inline]
-#[must_use]
-pub fn clock_gettime(id: ClockId) -> Timespec {
-    backend::time::syscalls::clock_gettime(id)
-}
-
-/// Like [`clock_gettime`] but with support for dynamic clocks.
-///
-/// # References
-///  - [POSIX]
-///  - [Linux]
-///
-/// [POSIX]: https://pubs.opengroup.org/onlinepubs/9799919799/functions/clock_gettime.html
-/// [Linux]: https://man7.org/linux/man-pages/man2/clock_gettime.2.html
-#[cfg(not(target_os = "wasi"))]
-#[inline]
-pub fn clock_gettime_dynamic(id: DynamicClockId<'_>) -> io::Result<Timespec> {
-    backend::time::syscalls::clock_gettime_dynamic(id)
-}
-
-/// `clock_settime(id, timespec)`—Sets the current value of a settable clock.
-///
-/// This fails with [`io::Errno::INVAL`] if the clock is not settable, and
-/// [`io::Errno::ACCESS`] if the current process does not have permission to
-/// set it.
-///
-/// # References
-///  - [POSIX]
-///  - [Linux]
-///  - [FreeBSD]
-///  - [NetBSD]
-///  - [OpenBSD]
-///  - [DragonFly BSD]
-///  - [illumos]
-///
-/// [POSIX]: https://pubs.opengroup.org/onlinepubs/9799919799/functions/clock_settime.html
-/// [Linux]: https://man7.org/linux/man-pages/man2/clock_settime.2.html
-/// [FreeBSD]: https://man.freebsd.org/cgi/man.cgi?query=clock_settime&sektion=2
-/// [NetBSD]: https://man.netbsd.org/clock_settime.2
-/// [OpenBSD]: https://man.openbsd.org/clock_settime.2
-/// [DragonFly BSD]: https://man.dragonflybsd.org/?command=clock_settime&section=2
-/// [illumos]: https://illumos.org/man/3C/clock_settime
-#[cfg(not(any(
-    target_os = "redox",
-    target_os = "wasi",
-    all(apple, not(target_os = "macos"))
-)))]
-#[inline]
-pub fn clock_settime(id: ClockId, timespec: Timespec) -> io::Result<()> {
-    backend::time::syscalls::clock_settime(id, timespec)
-}
diff --git a/vendor/rustix/src/time/mod.rs b/vendor/rustix/src/time/mod.rs
deleted file mode 100644
index c633e767..00000000
--- a/vendor/rustix/src/time/mod.rs
+++ /dev/null
@@ -1,11 +0,0 @@
-//! Time-related operations.
-
-mod clock;
-#[cfg(any(linux_kernel, target_os = "fuchsia"))]
-mod timerfd;
-
-// TODO: Convert WASI'S clock APIs to use handles rather than ambient clock
-// identifiers, update `wasi-libc`, and then add support in `rustix`.
-pub use clock::*;
-#[cfg(any(linux_kernel, target_os = "fuchsia"))]
-pub use timerfd::*;
diff --git a/vendor/rustix/src/time/timerfd.rs b/vendor/rustix/src/time/timerfd.rs
deleted file mode 100644
index d1d2a17f..00000000
--- a/vendor/rustix/src/time/timerfd.rs
+++ /dev/null
@@ -1,59 +0,0 @@
-use crate::fd::{AsFd, OwnedFd};
-use crate::timespec::Timespec;
-use crate::{backend, io};
-
-pub use backend::time::types::{TimerfdClockId, TimerfdFlags, TimerfdTimerFlags};
-
-/// `struct itimerspec` for use with [`timerfd_gettime`] and
-/// [`timerfd_settime`].
-///
-/// [`timerfd_gettime`]: crate::time::timerfd_gettime
-/// [`timerfd_settime`]: crate::time::timerfd_settime
-#[derive(Debug, Clone)]
-pub struct Itimerspec {
-    /// Interval between times.
-    pub it_interval: Timespec,
-    /// Value of the time.
-    pub it_value: Timespec,
-}
-
-/// `timerfd_create(clockid, flags)`—Create a timer.
-///
-/// For a higher-level API to timerfd functionality, see the [timerfd] crate.
-///
-/// [timerfd]: https://crates.io/crates/timerfd
-///
-/// # References
-///  - [Linux]
-///
-/// [Linux]: https://man7.org/linux/man-pages/man2/timerfd_create.2.html
-#[inline]
-pub fn timerfd_create(clockid: TimerfdClockId, flags: TimerfdFlags) -> io::Result<OwnedFd> {
-    backend::time::syscalls::timerfd_create(clockid, flags)
-}
-
-/// `timerfd_settime(clockid, flags, new_value)`—Set the time on a timer.
-///
-/// # References
-///  - [Linux]
-///
-/// [Linux]: https://man7.org/linux/man-pages/man2/timerfd_settime.2.html
-#[inline]
-pub fn timerfd_settime<Fd: AsFd>(
-    fd: Fd,
-    flags: TimerfdTimerFlags,
-    new_value: &Itimerspec,
-) -> io::Result<Itimerspec> {
-    backend::time::syscalls::timerfd_settime(fd.as_fd(), flags, new_value)
-}
-
-/// `timerfd_gettime(clockid, flags)`—Query a timer.
-///
-/// # References
-///  - [Linux]
-///
-/// [Linux]: https://man7.org/linux/man-pages/man2/timerfd_gettime.2.html
-#[inline]
-pub fn timerfd_gettime<Fd: AsFd>(fd: Fd) -> io::Result<Itimerspec> {
-    backend::time::syscalls::timerfd_gettime(fd.as_fd())
-}