add public bucket listing lint

[dnywh]

Summary

• add a new 0025_public_bucket_allows_listing security lint for public storage buckets that also have bucket-scoped SELECT policies on storage.objects
• include bucket and policy metadata so Studio can render affected buckets cleanly and support future per-resource handling
• add lint docs, regression coverage, unionability updates, and regenerate splinter.sql

Why

This moves the public-bucket listing warning into Splinter as the source of truth rather than keeping it as a client-side-only signal in supabase/supabase.

The lint is intentionally narrow: it does not warn on public buckets in general. It only warns when a public bucket also has one or more matching SELECT policies that make its contents listable.

Validation

• docker rmi -f dockerfiles-test && SUPABASE_VERSION=15.1.1.13 docker-compose -f dockerfiles/docker-compose.yml run --rm test
• pre-commit hooks during commit

[kemaldotearth]

Approving this as it works locally.

[dnywh]

Wouldn’t let me commit otherwise.

With language: python, pre-commit creates a virtualenv for the hook and runs it with a managed Python binary — no dependency on system python or python3, works the same on macOS, Linux, and Windows.