Use hermetic jq toolchain for PGP audit rules

[Copilot]

The PGP audit was implemented as shell scripts that could run host jq, making the security audit itself non-hermetic. This moves audit evaluation into Bazel/Starlark-backed jq actions using the resolved aspect_bazel_lib jq toolchain.

• Hermetic audit rules

  • Added //pgp/audit:defs.bzl with pgp_audit, pgp_audit_test, and runnable //pgp/audit:audit.
  • Audit reports are generated as cacheable Bazel actions from captured aquery JSON.
  • The runnable audit launcher resolves jq from runfiles, never $PATH.

• jq filter-based audit logic

  • Added pgp/audit/lib.jq and pgp/audit/audit.jq.
  • Audit output is structured JSON:

    {
      "actions": 4,
      "failures": []
    }

• Fixture generation without shell jq

  • Replaced shell-generated broken audit fixtures with Bazel jq() targets.
  • Added breaker filters for missing exec requirements, env leaks, passphrase argv leaks, and key-material inputs.

• Live audit cleanup

  • //pgp/test:live_audit now only captures live bazel aquery output, then runs //pgp/audit:audit.
  • Removed JQ_BIN and deleted the old shell audit scripts.

• Input classification fix

  • Replaced basename-based tool filtering with configuration-based tool artifact detection.
  • Updated the signing analysis test to subtract signer runfiles/executable instead of matching stub_signer by name.

Example usage:

load("@envoy_toolshed//pgp/audit:defs.bzl", "pgp_audit", "pgp_audit_test")

pgp_audit(
    name = "signing_audit_report",
    aquery = ":captured.json",
)

pgp_audit_test(
    name = "signing_audit_test",
    aquery = ":captured.json",
)