Complete Rego v1 migration safeguards

[dakshhhhh16]

Summary

This completes the remaining Rego v1 migration work before starting with the Phase 4.

Minder can already detect both Rego versions and warn users about legacy policies. This adds the final enforcement step, allowing deployments to reject Rego v0 policies through a feature flag while still providing clear migration guidance.

Part of #5262.

What changed

• Added the rego_v1_refuse_v0 feature flag.
• Rejects V0-only policies during rule type creation and updates when refusal is enabled.
• Returns actionable guidance recommending opa fmt --v0-v1.
• Updated minder rule-type lint to validate policies using Rego v1 syntax.
• Added tests covering V0 refusal, V1 acceptance, invalid policies, and CLI lint behavior.
• Migrated remaining documentation, protobuf test policies, CLI fixtures, and golden files to import rego.v1.
• Removed all remaining future.keywords imports.
• Preserved intentional V0 compatibility fixtures used to verify detection, warnings, and fallback behavior until Phase 4 removes that support.

Rollout behavior

• With refusal disabled, existing Rego v0 policies continue to work.
• With rego_v1_refuse_v0 enabled, V0-only policies are rejected.
• Rego v1 policies continue to be accepted.
• Users receiving a refusal are told how to migrate their policy with OPA's formatter.

Testing

The complete repository test suite passes:

TMPDIR=/private/tmp go test ./...

[dakshhhhh16]

@evankanderson,
I have completed the migration (i.e all four phases locally) after this pr is merged I'll open the final pr for the migration which will close the parent issue #5262

[coveralls]

Coverage is 60.926% — dakshhhhh16:rego-v1-phase3-completion into mindersec:main. No base build found for mindersec:main.