[Authz] Add QueryAllowedProjects client method

[TomerShor]

📝 Description

Adds a third query method, QueryAllowedProjects, to the OPA Client interface. It calls the new allowed_projects Rego rule (orca PR #707) and returns the set of project names the caller is allowed to read or list. A returned slice containing "*" signals "all projects accessible" — callers treat "*" as a wildcard; no concrete names are returned alongside it.

This gives consumers a single OPA query to compute project-scoped visibility instead of filtering per-resource paths.

---

🛠️ Changes Made

• types.go: new Config.AllowedProjectsQueryPath field; new AllowedProjectsRequest/AllowedProjectsRequestInput/AllowedProjectsResponse types.
• opa.go: extend Client interface with QueryAllowedProjects(ctx, *PermissionOptions) ([]string, error).
• http.go:
  • Extract a private doRequest helper that all three query methods share (URL build, headers, marshal, retry loop, verbose request/response logging, unmarshal). Existing QueryPermissions and QueryPermissionsMultiResources are refactored onto it; observable behavior (retry timing, log keys, error wrapping) is unchanged.
  • Add QueryAllowedProjects. Override-header bypass returns ["*"], consistent with the other methods' bypass semantics.
  • NewHTTPClient gains an allowedProjectsQueryPath parameter.
• nop.go: implement the new method, returning ["*"] (fail-open, consistent with the other Nop methods).
• mock.go: testify passthrough.
• factory.go: thread Config.AllowedProjectsQueryPath into NewHTTPClient.
• README.md: document the new method and config field.

---

✅ Checklist

• I updated the documentation (if applicable) — README.md
• I have tested the changes in this PR

---

🧪 Testing

Unit tests in http_test.go (build tag test_unit). The existing in-test OPA httptest.Server gains a third route at /v1/data/platform/authz/allowed_projects plus a fixture-backed test helper that emulates the rego rule.

Five new cases:

• TestQueryAllowedProjects_Wildcard — admin id → ["*"].
• TestQueryAllowedProjects_ConcreteProjects — two ids' concrete names unioned ({"abc","def"}, asserted with ElementsMatch since the rego returns a set).
• TestQueryAllowedProjects_NoProjects — unknown id → empty.
• TestQueryAllowedProjects_WithOverride — override header → ["*"], server not hit (asserted via a request-count counter).
• TestQueryAllowedProjects_EmptyIds — empty MemberIds → empty.

Verification:

• make test — 10/10 pass (5 new + 5 existing).
• make lint — 0 issues.
• go vet ./... — clean.

---

🔗 References

• Ticket link: IG4-2244
• Design docs links: n/a
• External links: orca PR #707 — adds the allowed_projects Rego rule this method consumes.

---

🚨 Breaking Changes?

• Yes (explain below)
• No

NewHTTPClient gains a new allowedProjectsQueryPath parameter (positioned between permissionFilterPath and requestTimeout). Direct callers of NewHTTPClient must add the new argument.

The Client interface also grows a method (QueryAllowedProjects) — any custom implementations of Client outside this repo must add it.

Callers using only the documented CreateOpaClient(logger, *Config) entry point are unaffected at the call site, but should set Config.AllowedProjectsQueryPath before invoking the new method.

---

🔍️ Additional Notes

The doRequest extraction is a refactor of pre-existing duplication, not a behavior change. Reviewers may want to spot-check that retry timing (6s total, 1s interval), verbose log keys (requestBody, requestURL, responseBody), and error wrapping ("Failed to send HTTP request to OPA") are preserved exactly across the two existing methods.

PermissionOptions.RaiseForbidden and SkipLoggingForbidden are accepted on the new method for API consistency but, as in the existing methods, are passthrough fields not acted on inside the client.

[liranbg]

lgtm. minor fixes

[liranbg]

wrap err

[liranbg]

wrap, and do for the rest as well