feat: migrate from Cedar to SpiceDB authorization system

This is a major architectural change that replaces the Cedar policy-based
authorization system with SpiceDB's relation-based authorization.

Key changes:

- Migrate from Rust to Go implementation
- Replace Cedar policies with SpiceDB schema and relationships
- Switch from envoy `ext_authz` with Cedar to SpiceDB permission checks
- Update build system and dependencies for Go ecosystem
- Maintain Envoy integration for external authorization

This change enables more flexible permission modeling through SpiceDB's
Google Zanzibar inspired relation-based system, supporting complex
hierarchical permissions that were difficult to express in Cedar.

Breaking change: Existing Cedar policies and Rust-based configuration
will no longer work and need to be migrated to SpiceDB schema.

1 files changed, 0 insertions, 52 deletions

diff --git a/vendor/same-file/src/unknown.rs b/vendor/same-file/src/unknown.rs
deleted file mode 100644
index 6bfbdea0..00000000
--- a/vendor/same-file/src/unknown.rs
+++ /dev/null
@@ -1,52 +0,0 @@
-use std::fs::File;
-use std::io;
-use std::path::Path;
-
-static ERROR_MESSAGE: &str = "same-file is not supported on this platform.";
-// This implementation is to allow same-file to be compiled on
-// unsupported platforms in case it was incidentally included
-// as a transitive, unused dependency
-#[derive(Debug, Hash)]
-pub struct Handle;
-
-impl Eq for Handle {}
-
-impl PartialEq for Handle {
-    fn eq(&self, _other: &Handle) -> bool {
-        unreachable!(ERROR_MESSAGE);
-    }
-}
-
-impl Handle {
-    pub fn from_path<P: AsRef<Path>>(_p: P) -> io::Result<Handle> {
-        error()
-    }
-
-    pub fn from_file(_file: File) -> io::Result<Handle> {
-        error()
-    }
-
-    pub fn stdin() -> io::Result<Handle> {
-        error()
-    }
-
-    pub fn stdout() -> io::Result<Handle> {
-        error()
-    }
-
-    pub fn stderr() -> io::Result<Handle> {
-        error()
-    }
-
-    pub fn as_file(&self) -> &File {
-        unreachable!(ERROR_MESSAGE);
-    }
-
-    pub fn as_file_mut(&self) -> &mut File {
-        unreachable!(ERROR_MESSAGE);
-    }
-}
-
-fn error<T>() -> io::Result<T> {
-    Err(io::Error::new(io::ErrorKind::Other, ERROR_MESSAGE))
-}