Run buf Policies locally

[emcfarlane]

This PR adds support for running local buf Policies. Lint and breaking checks now invoke the set of policy rules alongside the set of configured rules. Only local policies are currently supported, remote will be added with lock file support. The annotations emitted now include the policy name alongside the plugin (e.g. <annotation> (buf-plugin-name, buf-policy-name)). An inbuilt plugin for a policy will include only the policy name.

As an example a policy can be expressed for the buf-plugin-suffix.wasm plugin in a policy.yaml file:

version: v2
lint:
  use:
    - SERVICE_BANNED_SUFFIXES
    - RPC_BANNED_SUFFIXES
plugins:
  - plugin: buf-plugin-suffix.wasm
    options:
      service_banned_suffixes:
        - Mock
        - Test
      rpc_banned_suffixes:
        - Element

Which can then be used in a buf.yaml file:

version: v2
lint:
  disable_builtin: true
policies:
  - policy: policy.yaml

And run with buf lint showing the output annotations for a simple test proto:

a.proto:8:1:Service name "AMock" has banned suffix "Mock". (buf-plugin-suffix.wasm, policy.yaml)
a.proto:9:3:Method name "AMock.GetAllAElement" has banned suffix "Element". (buf-plugin-suffix.wasm, policy.yaml)

[github-actions]

The latest Buf updates on your PR. Results from workflow Buf CI / buf (pull_request).

Build	Format	Lint	Breaking	Updated (UTC)
✅ passed	✅ passed	✅ passed	✅ passed	Jun 6, 2025, 3:13 PM

[doriable]

This mostly makes sense to me, left some comments around the plugin/policy config paths and avoiding passing the read bucket.

[doriable]

This is looking good, just left a couple of very basic comments. I think this behaviour is probably the most straightforward based on our discussions.