feat(dir): multiprovider OIDC-based external authorization module

[tkircsi]

Summary

Adds an OIDC-based ext-authz service with Casbin RBAC and an Envoy integration test setup.

Features

• OIDC ext-authz: gRPC service that validates JWT payloads, applies Casbin policies, and enforces deny lists
• Multiple issuers: Zitadel and GitHub OIDC via Envoy jwt_authn
• Header handling: Strip x-jwt-payload on JWT routes, strip Authorization before backend
• Dev path: /api/test accepts x-jwt-payload for testing without real JWTs

Changes

• New auth/authzserver/ module (config, rbac, payload, oidc_server)
• Integration test setup: docker-compose, mock-directory, Envoy config
• Envoy config fixes for v1.31 compatibility

[github-actions]

The latest Buf updates on your PR. Results from workflow Buf CI / verify-proto (pull_request).

Build	Format	Lint	Breaking	Updated (UTC)
✅ passed	⏩ skipped	⏩ skipped	✅ passed	Mar 20, 2026, 5:20 PM

[codecov]

Codecov Report

❌ Patch coverage is 85.63380% with 51 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
auth/cmd/envoy-authz/main.go	0.0%	18 Missing ⚠️
auth/authzserver/payload.go	91.8%	9 Missing and 3 partials ⚠️
auth/cmd/envoy-authz/test/mock-directory.go	0.0%	9 Missing ⚠️
auth/authzserver/rbac.go	84.2%	5 Missing and 1 partial ⚠️
auth/authzserver/config.go	91.2%	2 Missing and 1 partial ⚠️
auth/authzserver/oidc_server.go	97.2%	2 Missing and 1 partial ⚠️

📢 Thoughts on this report? Let us know!

[ramizpolic]

LGMT w/ nits