feat: add Azure Policy builtins with YAML test suite (microsoft#630)

* feat: add Azure Policy builtins with YAML test suite

Implement ARM template functions for Azure Policy evaluation:

Builtins:
- String: indexOf, lastIndexOf, trim, format, split, startsWith, endsWith,
  padLeft, concat, replace, toLower, toUpper, substring, guid, uniqueString
- DateTime: dateTimeAdd, dateTimeFromEpoch, dateTimeToEpoch, addDays
- Collection: intersection, union, take, skip, first, last, min, max,
  range, items, tryGet, tryIndexFromEnd, empty, array, createObject
- Encoding: base64, base64ToString, base64ToJson, uri, uriComponent,
  uriComponentToString, dataUri, dataUriToString
- Numeric: int, float, intDiv, intMod
- Misc: json, join, bool, string, coalesce, if, getParameter, resolveField
- Logic: logicAll, logicAny

Key implementation details:
- Unicode case-insensitive search via ICU4X case folding with single-pass
  fold_with_char_map() for indexOf/lastIndexOf
- .NET composite formatting (System.String.Format) with alignment, standard
  and custom datetime format specifiers, numeric format specifiers
- DateTime round-trip preserves input shape (Z vs +00:00, T vs space,
  fractional seconds) when no explicit output format is supplied
- Zero-cost as_str() helper borrows directly from Value::String(Rc<str>)
- BTreeSet<&Value> in array union avoids redundant cloning

Test suite:
- 53 YAML test files exercising all builtins via direct BUILTINS registry
- Coverage for edge cases: empty inputs, Unicode, fractional seconds,
  invalid alignment, unknown format specifiers, RFC3339 offset shapes

Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>

* fix: address PR review comments

- Fix percent_encode to only uppercase hex digits, not entire string
- Remove guid/uniqueString (unsupported); delete custom SHA-1 impl
- Replace unwrap_or(0) with proper error in format placeholder parsing
- Hoist CaseMapper into static CaseMapperBorrowed for zero per-call overhead
- Pre-allocate Vec in range() with_capacity
- Update bindings/ffi and bindings/ruby Cargo.lock
- Fix uri_component test expectations for correct case preservation

Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>

* fix: address second round of PR review comments

- float(): return Undefined when as_f64() fails instead of leaking
  the original non-f64 representation
- createObject(): reject odd number of arguments with an error
  (ARM-template parity)
- format(): error on unknown numeric format specifiers instead of
  silently passing through (matches .NET FormatException behavior)
- format(): cap alignment width at 10,000 to prevent DoS from
  user-controlled format strings like {0,1000000000}
- Add YAML test cases for all new error behaviors

Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>

* fix: address third round of PR review comments

- percent_decode: reject incomplete % escapes (e.g. "%", "%2") instead
  of treating them as literal characters
- parse_iso8601_duration: reject leftover digits without a unit designator
  at T boundary and end-of-input (e.g. "P1", "P1T2H")
- yaml_to_value: panic on unsupported YAML numeric representations instead
  of silently mapping to Null
- Revert unused src/languages/mod.rs changes (module is defined inline in
  lib.rs)

Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>

* fix: add missing edge-case tests and fix empty-delimiter panic

- fn_split: return input as single-element array for empty string
  delimiter instead of panicking (Rust's str::split("") panics)
- format: add test for F3 higher precision ({0:F3} + 1.23456 → 1.235)
- format: add test for N2 float with thousands separator
- format: add test for negative index error ({-1})
- split: add test for empty-string delimiter
- uri: add tests for query string and fragment in relative URI
- createObject: add test for non-string (numeric) keys

Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>

* fix: address fourth round of PR review comments

- Add MAX_VARIADIC_ARGS (64) constant for variadic builtin arity
  instead of registering with 0 (logic_all, logic_any, min, max,
  format, intersection, union, coalesce, createObject); set
  dateTimeAdd to exact arity 3

- Switch indexOf/lastIndexOf to UTF-16 code-unit indices to match
  .NET String.IndexOf semantics (track ch.len_utf16() in
  fold_with_char_map, use encode_utf16().count() for empty-needle
  lastIndexOf)

- Use DateTime::<Utc>::from_timestamp for explicit timezone type

- Remove stale docs/azure-policy/casing.md link from module doc

- Fix misleading comment in want_error test branch (code bails on
  Undefined, not accepts it)

Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>

---------

Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>

Author: anakrish

Cargo.lock

@@ -24,7 +24,7 @@ default = ["full-opa", "arc", "rvm"]
 
 arc = []
 ast = []
-azure_policy = ["dep:jsonschema", "arc", "dashmap"]
+azure_policy = ["dep:jsonschema", "dep:chrono", "dep:ipnet", "dep:icu_casemap", "arc", "dashmap"]
 azure-rbac = ["regex", "time", "net"]
 base64 = ["dep:data-encoding"]
 base64url = ["dep:data-encoding"]
@@ -117,6 +117,7 @@ jsonschema = { version = "0.30.0", default-features = false, optional = true }
 chrono = { version = "0.4.40", optional = true }
 chrono-tz = { version = "0.10.1", optional = true }
 ipnet = { version = "2.11.0", optional = true, default-features = false }
+icu_casemap = { version = "2.1", optional = true, default-features = false, features = ["compiled_data"] }
 
 serde_yaml = {version = "0.9.16", default-features = false, optional = true }
 # Specify thread_rng for in order to use random_range

Cargo.toml

@@ -0,0 +1,151 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+
+//! Shared helpers: type coercion, comparison, pattern matching, and path resolution.
+
+#![deny(
+    clippy::arithmetic_side_effects,
+    clippy::expect_used,
+    clippy::indexing_slicing,
+    clippy::panic,
+    clippy::shadow_unrelated,
+    clippy::unwrap_used,
+    clippy::missing_const_for_fn,
+    clippy::option_if_let_else,
+    clippy::semicolon_if_nothing_returned,
+    clippy::useless_let_if_seq
+)]
+
+use crate::languages::azure_policy::strings;
+use crate::value::Value;
+
+use alloc::string::{String, ToString as _};
+use alloc::vec::Vec;
+
+// ── Type helpers ──────────────────────────────────────────────────────
+
+pub const fn is_true(value: &Value) -> bool {
+    matches!(value, Value::Bool(true))
+}
+
+pub const fn is_undefined(value: &Value) -> bool {
+    matches!(value, Value::Undefined)
+}
+
+pub fn as_string(value: &Value) -> Option<String> {
+    match *value {
+        Value::String(ref s) => Some(s.to_string()),
+        _ => None,
+    }
+}
+
+/// Borrow the inner string of a `Value::String` without cloning.
+pub fn as_str(value: &Value) -> Option<&str> {
+    match *value {
+        Value::String(ref s) => Some(s),
+        _ => None,
+    }
+}
+
+/// Try to parse a string as a number for Azure Policy type coercion.
+pub fn try_coerce_to_number(s: &str) -> Option<crate::number::Number> {
+    use core::str::FromStr as _;
+    // Try integer first, then float.
+    i64::from_str(s.trim())
+        .map(crate::number::Number::from)
+        .ok()
+        .or_else(|| {
+            f64::from_str(s.trim())
+                .map(crate::number::Number::from)
+                .ok()
+        })
+}
+
+// ── Path resolution ───────────────────────────────────────────────────
+
+pub fn resolve_path(root: &Value, path: &str) -> Value {
+    let segments = tokenize_path(path);
+    let mut current = root.clone();
+
+    for segment in segments {
+        #[allow(clippy::pattern_type_mismatch)]
+        match &current {
+            Value::Object(map) => {
+                let mut next = None;
+                for (key, value) in map.iter() {
+                    if let Value::String(ref key_str) = *key {
+                        if strings::keys::eq(key_str, &segment) {
+                            next = Some(value.clone());
+                            break;
+                        }
+                    }
+                }
+
+                if let Some(value) = next {
+                    current = value;
+                } else {
+                    return Value::Undefined;
+                }
+            }
+            Value::Array(items) => {
+                let Ok(index) = segment.parse::<usize>() else {
+                    return Value::Undefined;
+                };
+
+                let Some(value) = items.get(index) else {
+                    return Value::Undefined;
+                };
+                current = value.clone();
+            }
+            _ => return Value::Undefined,
+        }
+    }
+
+    current
+}
+
+fn tokenize_path(path: &str) -> Vec<String> {
+    let mut segments = Vec::new();
+    let mut token = String::new();
+    let mut bracket = String::new();
+    let mut in_bracket = false;
+
+    for ch in path.chars() {
+        match ch {
+            '.' if !in_bracket => {
+                if !token.is_empty() {
+                    segments.push(token.clone());
+                    token.clear();
+                }
+            }
+            '[' => {
+                in_bracket = true;
+                if !token.is_empty() {
+                    segments.push(token.clone());
+                    token.clear();
+                }
+            }
+            ']' => {
+                in_bracket = false;
+                let cleaned = bracket.trim_matches('"').trim_matches('\'').to_string();
+                if !cleaned.is_empty() {
+                    segments.push(cleaned);
+                }
+                bracket.clear();
+            }
+            _ => {
+                if in_bracket {
+                    bracket.push(ch);
+                } else {
+                    token.push(ch);
+                }
+            }
+        }
+    }
+
+    if !token.is_empty() {
+        segments.push(token);
+    }
+
+    segments
+}